Archive
11 December 2020
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
Unscored —CVE-2020-27786 Public exploit
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissio…
-
Medium 5.3
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >…
-
Unscored —
Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration UR…
-
Medium 4.3
An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed…
-
Low 3.1
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics st…
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information discl…
-
Medium 5.3
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This af…
-
Medium 4.0
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms …
-
Medium 4.3
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via…
-
High 8.8
An out of bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 reconstructs paths from binary U…
-
High 7.5
A denial-of-service vulnerability exists in the Ethernet/IP server functionality of the EIP Stack Group OpENer 2.3 and …
-
Critical 9.8
An out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack Group OpENer 2.3 and d…
-
Unscored —
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker cou…
-
High 7.0
Uncontrolled Search Path Element in Adobe Prelude for Windows
Adobe Prelude version 9.0.1 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma…
-
High 7.0
Uncontrolled Search Path Element vulnerability in Lightroom Classic 10.0
Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in t…
-
Unscored —
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to versi…
-
Unscored —
Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated use…
-
Unscored —
Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. Affecting all 3.x and 4.x v…
-
Unscored —
Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitatio…
-
Unscored —
There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending …
-
Unscored —
An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (A…
-
Medium 4.3
A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to t…
-
Critical 9.8
Remote code execution in Apache Struts
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
KEV Nov 3, 2021 -
Unscored —
A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro …
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340,…
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Leg…
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Leg…
-
Unscored —
A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Mod…
-
Unscored —
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy …
-
Unscored —
A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, …
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Leg…
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerabili…
-
Medium 4.7
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258…
-
Unscored —
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original rel…
-
Unscored —
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and…
-
Unscored —
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that wou…
-
Unscored —
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that wou…
-
Unscored —
A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide…
-
Critical 9.8
A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all vers…
-
Unscored —
A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34* versi…