Archive
23 December 2020
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
Unscored —
RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unqu…
-
Unscored —
Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/pa…
-
Unscored —
ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=…
-
Unscored —
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, l…
-
Unscored —
A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically cr…
-
Unscored —
Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registr…
-
Unscored —
SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass t…
-
Unscored —
SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authe…
-
Unscored —
SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. After the …
-
Unscored —CVE-2020-28070 EPSS 23%
SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from G…
-
Unscored —
Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowin…
-
Unscored —
CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' paramete…
-
Unscored —
CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' param…
-
Unscored —
Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions.
-
Unscored —
Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages.
-
Unscored —
Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums.
-
Medium 6.2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local att…
-
Unscored —
An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. It relies on broken enc…
-
Unscored —
An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation…
-
Unscored —
An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. Its software-update packages are…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows au…
-
Unscored —
An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated rem…
-
Unscored —
In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files con…
-
Unscored —
An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=…
-
Unscored —
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site sc…
-
Unscored —
An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection …
-
Unscored —
In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via t…
-
Unscored —
In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/i…
-
Unscored —
In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser…
-
High 7.2
Dolibarr authenticated Remote Code Execution
Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr…
-
Critical 9.8
MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication.
-
Critical 9.8
MOXA NPort IAW5000A-I/O Series
The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.
-
Medium 5.3
MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization.
-
High 8.8
MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies.
-
High 8.8
MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges.
-
High 7.5
MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext.
-
Unscored —
SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.
-
Unscored —
Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme …
-
Unscored —
Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?re…