Archive
18 December 2020
Vulnerabilities first published on this day (UTC), newest first.
66 results · Feed
-
Unscored —
A potential security vulnerability has been identified in the HPE StoreEver MSL2024 Tape Library and HPE StoreEver 1/8 …
-
Unscored —
A potential security vulnerability has been identified in HPE iLO Amplifier Pack server version 1.70. The vulnerability…
-
Unscored —
A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerabil…
-
Unscored —
A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthenti…
-
Unscored —
HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling…
-
Unscored —
HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of m…
-
Unscored —
Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbi…
-
Unscored —
In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verifica…
-
Critical 9.3
A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker c…
-
High 8.8CVE-2020-13519 Public exploit
A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A…
-
High 8.8
A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT C…
-
High 8.8
A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT C…
-
High 8.8
A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT C…
-
High 8.8
A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0. A…
-
Unscored —
Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2…
-
Unscored —CVE-2020-20300 Scanner template
SQL injection vulnerability in the wp_where function in WeiPHP 5.0.
-
Unscored —
WeiPHP 5.0 does not properly restrict access to pages, related to using POST.
-
Unscored —
ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to sen…
-
High 8.9
XSS in OpenSlides
OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-sit…
-
Unscored —CVE-2020-20285 Scanner template
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
-
Unscored —
An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.1…
-
Unscored —
There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server ve…
-
Medium 4.7
CORS configuration is possibly vulnerable
Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is all…
-
Medium 4.3
IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicio…
-
Unscored —CVE-2020-25901 Public exploit
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious w…
-
Unscored —
A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote a…
-
Unscored —
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in o…
-
Medium 4.3
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can…
-
Medium 4.2
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse t…
-
Low 3.1
An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download doc…
-
High 8.8
tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to th…
-
Medium 6.5
In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile i…
-
Medium 4.3
An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /a…
-
Medium 4.3
In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not in…
-
Medium 5.3
In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments wi…
-
Unscored —
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
-
Unscored —
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
-
Unscored —
An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider al…
-
Unscored —
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any application may establ…
-
Unscored —
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can byp…