Archive
29 December 2020
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
Medium 6.1
TwitterServer Cross-site Scripting via /histograms endpoint
server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
-
Unscored —
The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.
-
Unscored —
There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product. A module does not deal with…
-
Unscored —
There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authentica…
-
Unscored —
There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with speci…
-
Unscored —
There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2)…
-
Unscored —
There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacke…
-
Critical 9.8
Prototype pollution vulnerability in 'predefine'
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
flattenizer vulnerable to prototype pollution
Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
shvl vulnerable to prototype pollution
Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution vulnerability in 'libnested'
Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in getobject
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in set-object-value
Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution vulnerability in 'deep-set'
Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
dset vulnerable to prototype pollution
Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Medium 4.8CVE-2020-29470 Public exploit
OpenCart Cross-site Scripting (XSS) in the Subject field of mail.
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS tri…
-
Medium 4.8CVE-2020-29471 Public exploit
OpenCart Stored Cross-Site Scripting
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.
-
Unscored —CVE-2020-5807 EPSS 39%
An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the Facto…
-
Unscored —CVE-2020-5801 EPSS 30%
An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled e…
-
Unscored —
An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowse…
-
Unscored —CVE-2020-5802 EPSS 45%
An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specia…
-
Unscored —CVE-2020-29475 Public exploit
nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability c…
-
High 8.1CVE-2020-17533 Public exploit
Apache Accumulo Improper Handling of Insufficient Permissions
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values o…
-
High 8.8
Command Injection Vulnerability in QTS and QuTS hero
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.
-
Unscored —
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.