Archive
December 2020
Vulnerabilities first published in this month (UTC), newest first.
1,551 results · Feed
-
Medium 5.4
Umbraco CMS vulnerable to stored XSS
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbr…
-
Unscored —CVE-2020-5810 EPSS 62%
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media …
-
Medium 6.5CVE-2020-5811 Public exploit
Authenticated path traversal in Umbraco CMS
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
-
Unscored —CVE-2020-29233 Public exploit
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can all…
-
Unscored —CVE-2020-29469 Public exploit
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attack…
-
Unscored —CVE-2020-35241 Public exploit
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow a…
-
Unscored —
FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an a…
-
Unscored —CVE-2020-29477 Public exploit
Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allo…
-
Unscored —
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before …
-
Unscored —
An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit produc…
-
Unscored —
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
-
Unscored —
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
-
Unscored —
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
-
Low 2.6
XXE in Nokogiri
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external …
-
Unscored —
Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx ser…
-
Unscored —
Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx se…
-
High 8.4
NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection.
-
Medium 4.3
Certain NETGEAR devices are affected by CSRF. This affects GS716Tv3 before 6.3.1.36 and GS724Tv4 before 6.3.1.36.
-
High 7.5
NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
-
High 7.1
NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
-
High 8.3
NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
-
High 8.1
Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.…
-
Unscored —
Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, …
-
Medium 6.5
Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.…
-
Medium 6.2
Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.…
-
High 8.3
NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-20…
-
Medium 4.5
NETGEAR R7800 devices before 1.0.2.74 are affected by a buffer overflow by an authenticated user.
-
High 8.0
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D3600 before 1.0.0.76,…
-
High 7.6
NETGEAR WAC104 devices before 1.0.4.13 are affected by a buffer overflow by an authenticated user.
-
High 8.8
NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an authenticated user.
-
Medium 6.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56,…
-
Medium 6.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.68,…
-
High 8.3
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7500v2 before 1.0.3.4…
-
Medium 6.1
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.58,…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBS40V before 2.6.1.4,…
-
Critical 9.8
NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated attacker.
-
Critical 9.3
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1…
-
High 8.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D360…
-
High 8.3
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.…
-
High 7.5
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects CBR40 before 2.5.0.14, RBW30 …