New vulnerabilities from the NVD: CVE-2020-12644 | | OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API. Published at: August 31, 2020 at 06:15PM View on website August 31, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12643 | | OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address. Published at: August 31, 2020 at 06:15PM View on website August 31, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11618 | | THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start on boot, which allows an attacker on the local network to achieve root access via the TELNET protocol. Published at: August 31, 2020 at 06:15PM View on website August 31, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11617 | | The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which allows a man-in-the-middle attacker to modify the data delivered to the client. Published at: August 31, 2020 at 06:15PM View on website August 31, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-14178 | | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0. Published at: September 01, 2020 at 08:15AM View on website September 01, 2020 at 01:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12776 | | Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie. Published at: September 01, 2020 at 11:15AM View on website September 01, 2020 at 01:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-12475 | | A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service . Published at: September 01, 2020 at 03:15PM View on website September 01, 2020 at 05:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-5645 | | By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server. Published at: September 01, 2020 at 06:15PM View on website September 01, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2012-3341 | | IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 78294. Published at: September 01, 2020 at 08:15PM View on website September 01, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2012-3340 | | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 78291. Published at: September 01, 2020 at 08:15PM View on website September 01, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2012-3338 | | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new user account functionality. An attacker could exploit this vulnerability to create unprivileged user accounts. IBM X-Force ID: 78286. Published at: September 01, 2020 at 08:15PM View on website September 01, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2012-3337 | | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to download arbitrary files on the system. IBM X-Force ID: 78284. Published at: September 01, 2020 at 07:15PM View on website September 01, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2012-3336 | | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to multiple scripts, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 78282. Published at: September 01, 2020 at 07:15PM View on website September 01, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12621 | | The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component. Published at: September 02, 2020 at 08:15PM View on website September 02, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12058 | | Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php. Published at: September 03, 2020 at 05:15PM View on website September 03, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-10679 | | Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reuters\Eikon permissions. Published at: September 03, 2020 at 06:15PM View on website September 03, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11579 | | An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled. Published at: September 03, 2020 at 09:15PM View on website September 03, 2020 at 11:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10720 | | A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system. Published at: September 03, 2020 at 09:15PM View on website September 03, 2020 at 11:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-11928 | | An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially crafted live location message. Published at: September 04, 2020 at 12:15AM View on website September 04, 2020 at 01:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12248 | | In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled. Published at: September 04, 2020 at 07:15AM View on website September 04, 2020 at 08:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12247 | | In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur. Published at: September 04, 2020 at 07:15AM View on website September 04, 2020 at 08:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11493 | | In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject. Published at: September 04, 2020 at 07:15AM View on website September 04, 2020 at 08:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-3881 | | Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed. Published at: September 04, 2020 at 03:15PM View on website September 04, 2020 at 05:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-20916 | | The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. Published at: September 04, 2020 at 11:15PM View on website September 05, 2020 at 01:36AM via National Vulnerability Database |
Няма коментари:
Публикуване на коментар