25 December 2020

10 results · Feed

• Unscored —
  CVE-2020-35712

  Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.

  Dec 25, 2020
• High 7.5
  CVE-2020-35711

  Dangling reference in `access::Map` with Constant

  An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling reference…

  arc-swap rust-arc-swap rust-arc-swap Debian Ubuntu crates.io
  Dec 25, 2020
• Unscored —
  CVE-2020-35710

  Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submiss…

  Dec 25, 2020
• Unscored —
  CVE-2020-35709

  bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../m…

  Dec 25, 2020
• Unscored —
  CVE-2020-35704

  Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.

  Dec 25, 2020
• Unscored —
  CVE-2020-35705

  Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.

  Dec 25, 2020
• Unscored —
  CVE-2020-35706

  Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.

  Dec 25, 2020
• Unscored —
  CVE-2020-35707

  Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.

  Dec 25, 2020
• Unscored —
  CVE-2020-35708

  phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Admini…

  Dec 25, 2020
• Unscored —
  CVE-2020-35702

  DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOT…

  Dec 25, 2020