Archive
16 December 2020
Vulnerabilities first published on this day (UTC), newest first.
45 results · Feed
-
Medium 5.3
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain s…
-
Medium 5.3
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release i…
-
Medium 5.9
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an remote attacker to obtain …
-
Medium 4.0
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally whi…
-
Medium 4.3
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 is vulnerable to cross-site request forge…
-
Medium 6.1
IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulner…
-
Medium 6.1
IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting. This vulnerability allows user…
-
Unscored —
Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthe…
-
Unscored —
A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSO…
-
Unscored —
Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated a…
-
Medium 6.4
Command Injection Vulnerability in systeminformation
In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
-
Critical 9.8
Command Injection
This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:
-
Unscored —
irfanView 4.56 contains an error processing parsing files of type .pcx. Which leads to out-of-bounds writing at i_view3…
-
Unscored —
AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user…
-
Unscored —
AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successf…
-
Unscored —
AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server. Every user …
-
Unscored —
AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can ex…
-
High 7.5
An issue was discovered in ML Report Program. There is a stack-based buffer overflow in function sub_41EAF0 at MLReport…
-
High 7.5
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. An unauthen…
-
Medium 5.8
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. An un…
-
Medium 6.1
Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in t…
-
Unscored —
AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcod…
-
Unscored —
AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris privat…
-
Unscored —
AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead …
-
Unscored —
AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privile…
-
Unscored —
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain acces…
-
Unscored —
The installer of the macOS Sensor for VMware Carbon Black Cloud (prior to 3.5.1) handles certain files in an insecure w…
-
Unscored —
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause…
-
Unscored —
TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not ena…
-
Unscored —
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.
-
Unscored —
An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: securit…
-
Unscored —
An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user acco…
-
Unscored —
An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communication Chann…
-
Unscored —
An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because…
-
Unscored —
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Trav…
-
Unscored —
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array…
-
Unscored —
An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC…
-
Unscored —
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC …
-
High 7.3CVE-2020-28458 Public exploit
Prototype Pollution
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
-
Unscored —
Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.…