Archive
3 February 2021
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
-
Unscored —
In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permis…
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
-
Unscored —
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
-
Unscored —
In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.
-
Unscored —
In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.
-
Medium 5.3
Incorrect Default Permissions in JetBrains Kotlin
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
-
Unscored —
In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.
-
Unscored —
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
-
Unscored —
In JetBrains Hub before 2020.1.12629, an open redirect was possible.
-
High 7.3
integer overflow in calloc
In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corrupti…
-
Unscored —
In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to loc…
-
Unscored —
In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.
-
Unscored —
In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to th…
-
Unscored —
Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5…
-
Unscored —
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote i…
-
Unscored —
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remote…
-
Unscored —CVE-2020-29164 Scanner template
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).
-
Unscored —
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection.
-
Unscored —
CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an adminis…
-
Unscored —
SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious conten…