Original release date: November 9, 2020
The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
High Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe — acrobat | Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary code as SYSTEM. Exploitation of this issue requires an attacker to socially engineer a victim, or the attacker must already have some access to the environment. | 2020-11-05 | 9.3 | CVE-2020-24433 MISC |
| google — chrome | Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | 7.5 | CVE-2020-16011 SUSE SUSE MISC MISC |
| qnap — music_station | If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11. | 2020-11-02 | 7.5 | CVE-2018-19950 CONFIRM |
| qualcomm — agatti_firmware | u’Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8053, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6390, QCA6574AU, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | 10 | CVE-2020-3654 CONFIRM MISC |
| qualcomm — agatti_firmware | u’While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral system enter into dead lock state.(This CVE is equivalent to InvalidConnectionRequest(CVE-2019-19193) mentioned in sweyntooth paper)’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8017, APQ8053, AR9344, Bitra, IPQ5018, Kamorta, MDM9607, MDM9640, MDM9650, MSM8996AU, Nicobar, QCA6174A, QCA6390, QCA6574AU, QCA9377, QCA9886, QCM6125, QCN7605, QCS404, QCS405, QCS605, QCS610, QRB5165, Rennell, SA415M, SA515M, Saipan, SC7180, SC8180X, SDA845, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | 7.8 | CVE-2020-3704 CONFIRM MISC |
| qualcomm — agatti_firmware | u’Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, Bitra, Kamorta, Nicobar, QCA6390, QCS404, QCS605, QCS610, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | 7.2 | CVE-2020-3690 CONFIRM MISC |
| qualcomm — agatti_firmware | u’Possible buffer overflow while updating output buffer for IMEI and Gateway Address due to lack of check of input validation for parameters received from server’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in Agatti, Kamorta, Nicobar, QCM6125, QCS610, Rennell, SA415M, Saipan, SC7180, SC8180X, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 | 2020-11-02 | 10 | CVE-2020-3692 CONFIRM MISC |
| qualcomm — agatti_firmware | u’Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8053, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, Nicobar, QCA6390, QCA6574AU, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | 10 | CVE-2020-3673 CONFIRM MISC |
| qualcomm — apq8009_firmware | u’Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client through webserver due to lack of array bound check.’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8953, MSM8996AU, QCA6574AU, QCS405, QCS610, QRB5165, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM8250 | 2020-11-02 | 10 | CVE-2020-3657 CONFIRM MISC |
| qualcomm — apq8009_firmware | u’Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, QCN7606, SA415M, SA515M, SA6155P, SA8155P, SC8180X, SDX55 | 2020-11-02 | 8.3 | CVE-2020-11155 CONFIRM MISC |
| qualcomm — apq8009_firmware | u’Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, QCN7606, SA415M, SA515M, SA6155P, SA8155P, SC8180X, SDX55 | 2020-11-02 | 8.3 | CVE-2020-11154 CONFIRM MISC |
| qualcomm — apq8053_firmware | u’Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link Layer Length Overfow issue (CVE-2019-16336,CVE-2019-17519) and Silent Length Overflow issue(CVE-2019-17518) mentioned in sweyntooth paper)’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8076, AR9344, Bitra, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, Nicobar, QCA6174A, QCA9377, QCM2150, QCM6125, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SC8180X, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130 | 2020-11-02 | 7.5 | CVE-2020-3703 CONFIRM MISC |
| qualcomm — apq8053_firmware | u’Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8053, QCA6390, QCA9379, QCN7605, SC8180X, SDX55 | 2020-11-02 | 10 | CVE-2020-11153 CONFIRM MISC |
| qualcomm — ipq4019_firmware | u’fscanf reads a string from a file and stores its contents on a statically allocated stack memory which leads to stack overflow’ in Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA9531, QCA9980 | 2020-11-02 | 7.5 | CVE-2020-11172 CONFIRM MISC |
| whatsapp — whatsapp | A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold. | 2020-11-03 | 7.5 | CVE-2020-1909 CONFIRM |
| wordpress — wordpress | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | 2020-11-02 | 7.5 | CVE-2020-28032 MISC MLIST MISC MISC DEBIAN |
| wordpress — wordpress | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | 2020-11-02 | 7.5 | CVE-2020-28035 MLIST MISC DEBIAN |
| wordpress — wordpress | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | 2020-11-02 | 7.5 | CVE-2020-28036 MISC MLIST MISC MISC DEBIAN |
| wordpress — wordpress | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). | 2020-11-02 | 7.5 | CVE-2020-28037 MISC MLIST MISC MISC DEBIAN |
Medium Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 6.8 | CVE-2020-24429 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 4.3 | CVE-2020-24438 MISC |
| adobe — acrobat | Acrobat Reader versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an input validation vulnerability when decoding a crafted codec that could result in the disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 4.3 | CVE-2020-24427 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 5.1 | CVE-2020-24428 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 5.8 | CVE-2020-24431 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 4.3 | CVE-2020-24434 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 4.3 | CVE-2020-24426 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 6.8 | CVE-2020-24437 MISC MISC |
| adobe — acrobat | Acrobat Pro DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit in that the victim must open a malicious document. | 2020-11-05 | 6.8 | CVE-2020-24436 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file in Acrobat Reader. | 2020-11-05 | 6.8 | CVE-2020-24435 MISC MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) and Adobe Acrobat Pro DC 2017.011.30175 (and earlier) are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the current user. To exploit this issue, an attacker must acquire and then modify a certified PDF document that is trusted by the victim. The attacker then needs to convince the victim to open the document. | 2020-11-05 | 6.8 | CVE-2020-24432 MISC |
| adobe — acrobat | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file. | 2020-11-05 | 6.8 | CVE-2020-24430 MISC |
| basercms — basercms | baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1. | 2020-10-30 | 6.5 | CVE-2020-15277 MISC MISC CONFIRM |
| google — chrome | Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15997 MISC MISC |
| google — chrome | Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15992 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in printing in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15993 MISC MISC |
| google — chrome | Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15995 MISC MISC |
| google — chrome | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16006 SUSE SUSE MISC MISC |
| google — chrome | Use after free in passwords in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15996 MISC MISC |
| google — chrome | Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16005 SUSE SUSE MISC MISC |
| google — chrome | Use after free in USB in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15998 MISC MISC |
| google — chrome | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16000 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16001 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | 2020-11-03 | 6.8 | CVE-2020-16002 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16004 SUSE SUSE MISC MISC |
| google — chrome | Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15990 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page. | 2020-11-03 | 4.3 | CVE-2020-15977 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15991 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16003 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15988 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | 2020-11-03 | 4.3 | CVE-2020-15982 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 4.3 | CVE-2020-15999 SUSE MISC MISC FEDORA |
| google — chrome | Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16010 MISC MISC |
| google — chrome | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15979 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page. | 2020-11-03 | 4.3 | CVE-2020-15985 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted URL. | 2020-11-03 | 4.3 | CVE-2020-15984 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15974 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 4.3 | CVE-2020-15986 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | 2020-11-03 | 4.3 | CVE-2020-15981 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. | 2020-11-03 | 4.3 | CVE-2020-6557 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-16009 SUSE SUSE MISC MISC |
| google — chrome | Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a crafted HTML page. | 2020-11-03 | 4.4 | CVE-2020-15983 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15994 MISC MISC |
| google — chrome | Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15975 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15976 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. | 2020-11-03 | 6.8 | CVE-2020-15978 SUSE MISC MISC FEDORA FEDORA |
| ibm — i2_ibase | IBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 184579. | 2020-10-30 | 6.8 | CVE-2020-4588 XF CONFIRM |
| ibm — i2_ibase | IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184574. | 2020-10-30 | 5 | CVE-2020-4584 XF CONFIRM |
| icewarp — mail_server | IceWarp 11.4.5.0 allows XSS via the language parameter. | 2020-11-02 | 4.3 | CVE-2020-27982 MISC |
| jenkins — active_directory | A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials. | 2020-11-04 | 4.3 | CVE-2020-2303 MLIST CONFIRM |
| jenkins — active_directory | A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page. | 2020-11-04 | 4 | CVE-2020-2302 CONFIRM |
| jenkins — aws_global_configuration | A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration. | 2020-11-04 | 4 | CVE-2020-2311 CONFIRM |
| jenkins — azure_key_vault | A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | 2020-11-04 | 4 | CVE-2020-2313 CONFIRM |
| jenkins — kubernetes | A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names. | 2020-11-04 | 4 | CVE-2020-2308 CONFIRM |
| jenkins — kubernetes | A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | 2020-11-04 | 4 | CVE-2020-2309 CONFIRM |
| jenkins — mercurial | A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. | 2020-11-04 | 4 | CVE-2020-2306 CONFIRM |
| marmind — marmind | A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS. | 2020-11-05 | 4.3 | CVE-2020-26505 MISC MISC |
| oleacorner — olea_gift_on_order | The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal. | 2020-11-02 | 5 | CVE-2020-9368 MISC MISC |
| pimcore — pimcore | The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{“keyId”%3a”””,”groupId”%3a”‘asd’))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,”,11,12,”,14+from+users)+–+”}] | 2020-10-30 | 6.5 | CVE-2020-7759 CONFIRM CONFIRM |
| qnap — music_station | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11. | 2020-11-02 | 4.3 | CVE-2018-19951 CONFIRM |
| qnap — music_station | If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11. | 2020-11-02 | 5 | CVE-2018-19952 CONFIRM |
| qnap — photo_station | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. | 2020-11-02 | 4.3 | CVE-2018-19956 CONFIRM |
| qnap — photo_station | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. | 2020-11-02 | 4.3 | CVE-2018-19955 CONFIRM |
| qnap — photo_station | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. | 2020-11-02 | 4.3 | CVE-2018-19954 CONFIRM |
| qualcomm — agatti_firmware | u’Array index underflow issue in adsp driver due to improper check of channel id before used as array index.’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8953, MSM8996AU, QCA6390, QCA9531, QCM2150, QCS404, QCS405, QCS605, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | 4.6 | CVE-2020-11174 CONFIRM MISC |
| qualcomm — agatti_firmware | u’An Unaligned address or size can propagate to the database due to improper page permissions and can lead to improper access control’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Agatti, Bitra, Kamorta, QCA6390, QCS404, QCS610, Rennell, SA515M, SC7180, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 | 2020-11-02 | 4.6 | CVE-2020-3638 CONFIRM MISC |
| qualcomm — agatti_firmware | u’A buffer overflow could occur if the API is improperly used due to UIE init does not contain a buffer size a param’ in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Agatti, Kamorta, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SXR1130 | 2020-11-02 | 4.6 | CVE-2020-3678 CONFIRM MISC |
| qualcomm — agatti_firmware | u’Potential out of bounds read while processing downlink NAS transport message due to improper length check of Information Element(IEI) NAS message container’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCM6125, QCS605, QCS610, QM215, Rennell, SA415M, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130 | 2020-11-02 | 6.4 | CVE-2020-3670 CONFIRM MISC |
| qualcomm — agatti_firmware | u’QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by XBL Loader and applies them without validation’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8098, Bitra, IPQ6018, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8998, Nicobar, QCA6390, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | 4.6 | CVE-2020-3684 CONFIRM MISC |
| qualcomm — agatti_firmware | u’Out of bound access can happen in MHI command process due to lack of check of channel id value received from MHI devices’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9150, MDM9607, MDM9650, MSM8905, MSM8917, MSM8953, Nicobar, QCA6390, QCA9531, QCM2150, QCS404, QCS405, QCS605, QCS610, QM215, QRB5165, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM660, SDM670, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | 4.6 | CVE-2020-11125 CONFIRM MISC |
| qualcomm — agatti_firmware | u’Two threads running simultaneously from user space can lead to race condition in fastRPC driver’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8053, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MSM8953, Nicobar, QCA6390, QCS404, QCS405, QCS610, Rennell, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM632, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 | 2020-11-02 | 4.4 | CVE-2020-11173 CONFIRM MISC |
| qualcomm — apq8009_firmware | u’Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checking security permission for particular process’ in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8996AU, QCA4531, QCA6574AU, QCA9531, QCM2150, QCS605, SDM429W, SDX20, SDX24 | 2020-11-02 | 4.6 | CVE-2020-3696 CONFIRM MISC |
| qualcomm — apq8009_firmware | u’Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8098, Bitra, MSM8909W, MSM8996AU, Nicobar, QCM2150, QCS605, Saipan, SDM429W, SDX20, SM6150, SM8150, SM8250, SXR2130 | 2020-11-02 | 4.6 | CVE-2020-3693 CONFIRM MISC |
| qualcomm — apq8009_firmware | u’Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap configuration request received from peer device.’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, SA415M, SA515M, SC8180X, SDX55, SM8250 | 2020-11-02 | 4.8 | CVE-2020-11141 CONFIRM MISC |
| qualcomm — apq8009_firmware | u’Buffer over-read while processing received L2CAP packet due to lack of integer overflow check’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, QCN7606, SA415M, SA515M, SA6155P, SA8155P, SC8180X, SDX55 | 2020-11-02 | 6.4 | CVE-2020-11169 CONFIRM MISC |
| qualcomm — apq8053_firmware | u’Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS’ in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8076, MDM9640, MDM9650, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, QCA6174A, QCA9886, QCM2150, QM215, SDM429, SDM439, SDM450, SDM632 | 2020-11-02 | 5 | CVE-2020-11157 CONFIRM |
| qualcomm — bitra_firmware | u’Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in Bitra, Nicobar, Saipan, SM6150, SM8150, SM8250, SXR2130 | 2020-11-02 | 4.6 | CVE-2020-3694 CONFIRM MISC |
| qualcomm — qca6390_firmware | u’Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in QCA6390, QCN7605, QCS404, SA415M, SA515M, SC8180X, SDX55, SM8250 | 2020-11-02 | 4.8 | CVE-2020-11156 CONFIRM MISC |
| trendmicro — antivirus | Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash.nnrnAn attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. | 2020-10-30 | 6.9 | CVE-2020-27014 N/A N/A |
| wordpress — wordpress | WordPress before 5.5.2 allows CSRF attacks that change a theme’s background image. | 2020-11-02 | 4.3 | CVE-2020-28040 MISC MLIST MISC DEBIAN |
| wordpress — wordpress | WordPress before 5.5.2 allows stored XSS via post slugs. | 2020-11-02 | 4.3 | CVE-2020-28038 MISC MLIST MISC DEBIAN |
| wordpress — wordpress | WordPress before 5.5.2 allows XSS associated with global variables. | 2020-11-02 | 4.3 | CVE-2020-28034 MLIST MISC DEBIAN |
| wordpress — wordpress | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | 2020-11-02 | 5 | CVE-2020-28033 MLIST MISC DEBIAN |
| wordpress — wordpress | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. | 2020-11-02 | 6.4 | CVE-2020-28039 MISC MLIST MISC MISC DEBIAN |
| zte — zxa10_eodn_firmware | A ZTE product is impacted by an information leak vulnerability. An attacker could use this vulnerability to obtain the authentication password of the handheld terminal and access the device illegally for operation. This affects: ZXA10 eODN V2.3P2T1 | 2020-11-05 | 4 | CVE-2020-6877 MISC |
Low Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| basercms — basercms | baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1. | 2020-10-30 | 3.5 | CVE-2020-15273 MISC CONFIRM MISC |
| basercms — basercms | baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1. | 2020-10-30 | 3.5 | CVE-2020-15276 MISC MISC CONFIRM |
| evms — redcap | A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a message and send it to anyone on the platform including admins. The XSS payload would execute on the other account without interaction from the user on several pages. | 2020-11-02 | 3.5 | CVE-2020-27359 MISC MISC MISC |
| nedi — nedi | NeDi 1.9C allows inc/rt-popup.php d XSS. | 2020-11-02 | 3.5 | CVE-2020-23868 MISC |
| nedi — nedi | NeDi 1.9C allows pwsec.php oid XSS. | 2020-11-02 | 3.5 | CVE-2020-23989 MISC |
| trendmicro — antivirus | Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. | 2020-10-30 | 2.1 | CVE-2020-27015 N/A N/A |
Severity Not Yet Assigned
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe — acrobat_reader_dc |
Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process. | 2020-11-05 | not yet calculated | CVE-2020-24439 MISC |
| alerta — alerta |
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients. | 2020-11-06 | not yet calculated | CVE-2020-26214 MISC MISC MISC CONFIRM MISC MISC |
| apache — shiro |
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. | 2020-11-05 | not yet calculated | CVE-2020-17510 MLIST MISC |
| aruba — airwave_software |
A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. | 2020-11-04 | not yet calculated | CVE-2020-7129 MISC |
| aruba — airwave_software |
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. | 2020-11-04 | not yet calculated | CVE-2020-7128 MISC |
| asterisk — asterisk_open_source |
A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling. | 2020-11-06 | not yet calculated | CVE-2020-28327 MISC |
| asterisk — asterisk_open_source |
An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur. | 2020-11-06 | not yet calculated | CVE-2020-28242 MISC |
| audimexee — audimexee |
AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). If the recommended security configuration parameter “unique_error_numbers” is not set, remote attackers can inject arbitrary web script or HTML via ‘action, cargo, panel’ parameters that can lead to data leakage. | 2020-11-05 | not yet calculated | CVE-2020-28047 MISC |
| audimexee — audimexee |
SQL Injection vulnerability in “Documents component” found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the object_path parameter. | 2020-11-05 | not yet calculated | CVE-2020-28115 MISC |
| auth0 — ad-idap-connector |
ad-ldap-connector’s admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13. | 2020-11-06 | not yet calculated | CVE-2020-15259 MISC CONFIRM |
| axios — axios |
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address. | 2020-11-06 | not yet calculated | CVE-2020-28168 MISC |
| b.braun_melsungen_ag — onlinesuite |
A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user. | 2020-11-06 | not yet calculated | CVE-2020-25174 MISC |
| b.braun_melsungen_ag — onlinesuite |
A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. | 2020-11-06 | not yet calculated | CVE-2020-25172 MISC |
| b.braun_melsungen_ag — onlinesuite |
An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export. | 2020-11-06 | not yet calculated | CVE-2020-25170 MISC |
| bookstack — bookstack |
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in version 0.30.4. | 2020-11-03 | not yet calculated | CVE-2020-26210 MISC MISC MISC CONFIRM |
| bookstack — bookstack |
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4. | 2020-11-03 | not yet calculated | CVE-2020-26211 MISC MISC CONFIRM MISC |
| cellinx — nvt_web_server |
Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client side. | 2020-11-06 | not yet calculated | CVE-2020-28250 MISC MISC |
| check_point — endpoint_security_client |
Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL during a query for the Domain Name. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate. | 2020-11-02 | not yet calculated | CVE-2020-6014 MISC |
| check_point — endpoint_security_client |
Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of service log files in non-standard locations. | 2020-11-05 | not yet calculated | CVE-2020-6015 MISC |
| cisco — anyconnect_secure_mobility_client |
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system of the affected device. | 2020-11-06 | not yet calculated | CVE-2020-27123 CISCO |
| cisco — anyconnect_secure_mobility_client_software |
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to cause a targeted AnyConnect user to execute a malicious script. The vulnerability is due to a lack of authentication to the IPC listener. An attacker could exploit this vulnerability by sending crafted IPC messages to the AnyConnect client IPC listener. A successful exploit could allow an attacker to cause the targeted AnyConnect user to execute a script. This script would execute with the privileges of the targeted AnyConnect user. In order to successfully exploit this vulnerability, there must be an ongoing AnyConnect session by the targeted user at the time of the attack. To exploit this vulnerability, the attacker would also need valid user credentials on the system upon which the AnyConnect client is being run. Cisco has not released software updates that address this vulnerability. | 2020-11-06 | not yet calculated | CVE-2020-3556 CISCO |
| cisco — edge_fog_fabric |
A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on an affected device. The vulnerability is due to incorrect authorization enforcement on an affected system. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. | 2020-11-06 | not yet calculated | CVE-2020-26084 CISCO |
| cisco — identity_services_engine |
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. | 2020-11-06 | not yet calculated | CVE-2020-3551 CISCO |
| cisco — identity_services_engine |
A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a valid administrator account on an affected device. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to the system with a crafted Active Directory account. A successful exploit could allow the attacker to obtain root privileges on an affected device. | 2020-11-06 | not yet calculated | CVE-2020-27122 CISCO |
| cisco — identity_services_engine |
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need to have valid administrative credentials. | 2020-11-06 | not yet calculated | CVE-2020-26083 CISCO |
| cisco — integrated_management_controller |
A vulnerability in the web UI of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary code and execute arbitrary commands at the underlying operating system level. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary commands at the underlying operating system level. | 2020-11-06 | not yet calculated | CVE-2020-3371 CISCO |
| cisco — ios_xr_64-bit_software |
A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the management interface of hardware platforms that are running Cisco IOS XR Software only. The vulnerability exists because internal commands that are issued when the PXE network boot process is loading a software image are not properly verified. An attacker could exploit this vulnerability by compromising the PXE boot server and replacing a valid software image with a malicious one. Alternatively, the attacker could impersonate the PXE boot server and send a PXE boot reply with a malicious file. A successful exploit could allow the attacker to execute unsigned code on the affected device. Note: To fix this vulnerability, both the Cisco IOS XR Software and the BIOS must be upgraded. The BIOS code is included in Cisco IOS XR Software but might require additional installation steps. For further information, see the Fixed Software section of this advisory. | 2020-11-06 | not yet calculated | CVE-2020-3284 CISCO |
| cisco — ip_phones |
A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop responding to incoming calls, drop connected calls, or unexpectedly reload. The vulnerability is due to insufficient TCP ingress packet rate limiting. An attacker could exploit this vulnerability by sending a high and sustained rate of crafted TCP traffic to the targeted device. A successful exploit could allow the attacker to impact operations of the phone or cause the phone to reload, leading to a denial of service (DoS) condition. | 2020-11-06 | not yet calculated | CVE-2020-3574 CISCO |
| cisco — sd-wan_software | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root group on the underlying operating system. The vulnerability is due to incorrect permissions being set when the affected command is executed. An attacker could exploit this vulnerability by executing the affected command on an affected system. A successful exploit could allow the attacker to gain root privileges. | 2020-11-06 | not yet calculated | CVE-2020-3595 CISCO |
| cisco — sd-wan_software |
A vulnerability in the packet filtering features of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by crafting a malicious TCP packet with specific characteristics and sending it to a targeted device. A successful exploit could allow the attacker to bypass the L3 and L4 traffic filters and inject an arbitrary packet into the network. | 2020-11-06 | not yet calculated | CVE-2020-3444 CISCO |
| cisco — sd-wan_software |
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to a utility that is running on an affected system. A successful exploit could allow the attacker to gain root privileges. | 2020-11-06 | not yet calculated | CVE-2020-3593 CISCO |
| cisco — sd-wan_software |
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker could exploit this vulnerability by using an affected CLI utility that is running on an affected system. A successful exploit could allow the attacker to gain root privileges. | 2020-11-06 | not yet calculated | CVE-2020-3600 CISCO |
| cisco — sd-wan_software |
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted options to a specific command. A successful exploit could allow the attacker to gain root privileges. | 2020-11-06 | not yet calculated | CVE-2020-3594 CISCO |
| cisco — sd-wan_vmanage_software | A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the affected application. An attacker could exploit this vulnerability by sending malicious requests to the affected application. A successful exploit could allow the attacker to inject arbitrary commands and potentially gain elevated privileges. | 2020-11-06 | not yet calculated | CVE-2020-27129 CISCO |
| cisco — sd-wan_vmanage_software |
A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. | 2020-11-06 | not yet calculated | CVE-2020-3587 CISCO |
| cisco — sd-wan_vmanage_software |
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. | 2020-11-06 | not yet calculated | CVE-2020-3579 CISCO |
| cisco — sd-wan_vmanage_software |
A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. | 2020-11-06 | not yet calculated | CVE-2020-3591 CISCO |
| cisco — sd-wan_vmanage_software |
A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. | 2020-11-06 | not yet calculated | CVE-2020-3590 CISCO |
| cisco — sd-wan_vmanage_software |
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system. | 2020-11-06 | not yet calculated | CVE-2020-27128 CISCO |
| cisco — sd-wan_vmanage_software |
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system. The vulnerability is due to insufficient authorization checking on an affected system. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to gain privileges beyond what would normally be authorized for their configured user authorization level. This could allow the attacker to modify the configuration of an affected system. | 2020-11-06 | not yet calculated | CVE-2020-3592 CISCO |
| cisco — telepresence_collaboration_endpoint_software |
A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storage of sensitive information on an affected device. An attacker could exploit this vulnerability by accessing information that should not be accessible to users with low privileges. A successful exploit could allow the attacker to gain access to sensitive information. | 2020-11-06 | not yet calculated | CVE-2020-26086 CISCO |
| cisco — unified_communications_manager_im_and_presence_service_software |
A vulnerability in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Software could allow an authenticated, remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of login requests. An attacker could exploit this vulnerability by sending a crafted client login request to an affected device. A successful exploit could allow the attacker to cause a process to crash, resulting in a DoS condition for new login attempts. Users who are authenticated at the time of the attack would not be affected. There are workarounds that address this vulnerability. | 2020-11-06 | not yet calculated | CVE-2020-27121 CISCO |
| cisco — webex_meetings_desktop_app |
A vulnerability in virtualization channel messaging in Cisco Webex Meetings Desktop App for Windows could allow a local attacker to execute arbitrary code on a targeted system. This vulnerability occurs when this app is deployed in a virtual desktop environment and using virtual environment optimization. This vulnerability is due to improper validation of messages processed by the Cisco Webex Meetings Desktop App. A local attacker with limited privileges could exploit this vulnerability by sending malicious messages to the affected software by using the virtualization channel interface. A successful exploit could allow the attacker to modify the underlying operating system configuration, which could allow the attacker to execute arbitrary code with the privileges of a targeted user. Note: This vulnerability can be exploited only when Cisco Webex Meetings Desktop App is in a virtual desktop environment on a hosted virtual desktop (HVD) and is configured to use the Cisco Webex Meetings virtual desktop plug-in for thin clients. | 2020-11-06 | not yet calculated | CVE-2020-3588 CISCO |
| cisco — webex_network_player |
Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements of a Webex recording that is stored in the Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user. | 2020-11-06 | not yet calculated | CVE-2020-3573 CISCO |
| cisco — webex_network_recording_player_and_webex_player |
Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements of a Webex recording that is stored in the Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user. | 2020-11-06 | not yet calculated | CVE-2020-3604 CISCO |
| cisco — webex_network_recording_player_and_webex_player |
Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements of a Webex recording that is stored in the Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user. | 2020-11-06 | not yet calculated | CVE-2020-3603 CISCO |
| cybozu — garoon |
Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the bulletin board via unspecified vector. | 2020-11-06 | not yet calculated | CVE-2020-5643 MISC MISC |
| databaseschemaviewer — databaseschemaviewer |
DatabaseSchemaViewer before version 2.7.4.3 is vulnerable to arbitrary code execution if a user is tricked into opening a specially crafted `.dbschema` file. The patch was released in v2.7.4.3. As a workaround, ensure `.dbschema` files from untrusted sources are not opened. | 2020-11-04 | not yet calculated | CVE-2020-26207 MISC MISC CONFIRM |
| debian — bounty_castle_bc |
In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption. | 2020-11-02 | not yet calculated | CVE-2020-26939 MISC MISC MLIST |
| debian — raptor_xml_writer.c |
raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml). | 2020-11-06 | not yet calculated | CVE-2017-18926 MISC MLIST DEBIAN MISC |
| eramba — eramba |
eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users. | 2020-11-02 | not yet calculated | CVE-2020-28031 MISC MISC |
| f5 — big-ip | In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password. | 2020-11-05 | not yet calculated | CVE-2020-5943 MISC |
| f5 — big-ip | In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS). | 2020-11-05 | not yet calculated | CVE-2020-5946 MISC |
| f5 — big-ip |
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic. | 2020-11-05 | not yet calculated | CVE-2020-5939 MISC |
| f5 — big-ip |
On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel (TMM) to generate a core file and restart. This issue occurs when data exceeding the maximum limit of a hostname passes to the RESOLV::lookup command. | 2020-11-05 | not yet calculated | CVE-2020-5941 MISC |
| f5 — big-ip |
In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disabled Grafana reverse proxy in web service configuration. | 2020-11-05 | not yet calculated | CVE-2020-5944 MISC |
| f5 — big-ip |
In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin. | 2020-11-05 | not yet calculated | CVE-2020-5945 MISC |
| f5 — big-ip |
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility. | 2020-11-05 | not yet calculated | CVE-2020-5940 MISC |
| f5 — big-ip |
In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when processing Capabilities-Exchange-Answer (CEA) packets with certain attributes from the Policy and Charging Rules Function (PCRF) server, the Traffic Management Microkernel (TMM) may generate a core file and restart. | 2020-11-05 | not yet calculated | CVE-2020-5942 MISC |
| foxit — reader |
Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog. | 2020-11-02 | not yet calculated | CVE-2020-14425 MISC MISC MISC |
| fruitywifi_project — fruitywifi |
A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317. | 2020-11-05 | not yet calculated | CVE-2020-24849 MISC MISC MISC |
| fuel — cms |
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. | 2020-11-04 | not yet calculated | CVE-2020-26167 MISC MISC MISC MISC |
| git-lfs — git-lfs |
Git LFS 2.12.0 allows Remote Code Execution. | 2020-11-05 | not yet calculated | CVE-2020-27955 MISC FULLDISC MISC MISC MISC MISC |
| google — chrome | Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via crafted Intents. | 2020-11-03 | not yet calculated | CVE-2020-15980 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. | 2020-11-03 | not yet calculated | CVE-2020-15973 SUSE MISC MISC FEDORA FEDORA |
| google — chrome | Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted filesystem. | 2020-11-03 | not yet calculated | CVE-2020-16007 SUSE SUSE MISC MISC |
| google — chrome | Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC packet. | 2020-11-03 | not yet calculated | CVE-2020-16008 SUSE SUSE MISC MISC |
| google — chrome |
Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | not yet calculated | CVE-2020-15968 SUSE MISC MISC FEDORA FEDORA |
| google — chrome |
Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file. | 2020-11-03 | not yet calculated | CVE-2020-15989 SUSE MISC MISC FEDORA FEDORA |
| google — chrome |
Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | not yet calculated | CVE-2020-15970 SUSE MISC MISC FEDORA FEDORA |
| google — chrome |
Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | not yet calculated | CVE-2020-15971 SUSE MISC MISC FEDORA FEDORA |
| google — chrome |
Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | not yet calculated | CVE-2020-15972 SUSE MISC MISC FEDORA FEDORA |
| google — chrome |
Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2020-11-03 | not yet calculated | CVE-2020-15969 SUSE MISC MISC FEDORA FEDORA |
| google — chrome |
Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | 2020-11-03 | not yet calculated | CVE-2020-15967 SUSE MISC MISC FEDORA FEDORA |
| google — chrome |
Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream. | 2020-11-03 | not yet calculated | CVE-2020-15987 SUSE MISC MISC FEDORA FEDORA |
| hashicorp — consul_enterprise |
HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5. | 2020-11-04 | not yet calculated | CVE-2020-25201 CONFIRM MISC |
| hcl — digital_experience |
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site). | 2020-11-05 | not yet calculated | CVE-2020-14222 MISC |
| hcl — notes |
In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 previous to 11.0.1 FixPack 1, a vulnerability in the input parameter handling of the Notes Client could potentially be exploited by an attacker resulting in a buffer overflow. This could enable an attacker to crash HCL Notes or execute attacker-controlled code on the client. | 2020-11-05 | not yet calculated | CVE-2020-4097 MISC |
| hcl — notes |
HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. An attacker could use this vulnerability to execute script in a victim’s Web browser within the security context of the hosting Web site and/or steal the victim’s cookie-based authentication credentials. | 2020-11-05 | not yet calculated | CVE-2020-14240 MISC |
| hewlett_packard_enterprise — oneview_and_synergy_composer |
There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to Oneview and Synergy Composer: Update to version 5.5 of OneView, Composer, or Composer2. | 2020-11-06 | not yet calculated | CVE-2020-7198 MISC |
| hewlett_packard_enterprise — proliant_gen10_servers | A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board. | 2020-11-05 | not yet calculated | CVE-2020-7207 MISC |
| hindotech — hk1_s905x3_tv_box |
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb. | 2020-11-05 | not yet calculated | CVE-2020-27402 MISC MISC MISC MISC MISC |
| horizontcms — horizontcms |
An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager’s rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta. | 2020-11-05 | not yet calculated | CVE-2020-27387 MISC MISC |
| ibm — app_connect_enerprise_certified_container |
IBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim. IBM X-Force ID: 189219. | 2020-11-03 | not yet calculated | CVE-2020-4785 XF CONFIRM |
| ibm — maximo_anywhere |
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the confidentiality and integrity of the service. IBM X-Force ID: 161486 | 2020-11-03 | not yet calculated | CVE-2019-4349 XF CONFIRM |
| ibm — qradar_siem |
IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440. | 2020-11-05 | not yet calculated | CVE-2018-1725 XF CONFIRM |
| ibm — urbancode_deploy |
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181857. | 2020-11-06 | not yet calculated | CVE-2020-4483 XF CONFIRM |
| ibm — urbancode_deploy |
IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022. | 2020-11-03 | not yet calculated | CVE-2020-4649 XF CONFIRM |
| ibm — urbancode_deploy |
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. A user with access to a snapshot could apply unauthorized additional statuses via direct rest calls. IBM X-Force ID: 181856. | 2020-11-06 | not yet calculated | CVE-2020-4482 XF CONFIRM |
| ibm — urbancode_deploy |
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could be used in further attacks against the system. IBM X-Force ID: 181858. | 2020-11-06 | not yet calculated | CVE-2020-4484 XF CONFIRM |
| immuta — immuta |
Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application. An attacker could leverage this to redirect application users to a phishing website in an attempt to steal credentials. | 2020-11-05 | not yet calculated | CVE-2020-15951 MISC MISC MISC |
| immuta — immuta |
Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout. | 2020-11-05 | not yet calculated | CVE-2020-15950 MISC MISC MISC |
| immuta — immuta |
Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover. | 2020-11-05 | not yet calculated | CVE-2020-15949 MISC MISC MISC |
| immuta — immuta |
Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions. Additionally, unauthenticated attackers can phish unauthenticated Immuta users to steal credentials or force actions on authenticated users through reflected, DOM-based XSS. | 2020-11-05 | not yet calculated | CVE-2020-15952 MISC MISC MISC |
| intelliants — subrion_cms |
Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter. | 2020-11-04 | not yet calculated | CVE-2019-7356 MISC MISC |
| intermind — imind_server |
Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user’s session by sending a malicious file in the chat. | 2020-11-05 | not yet calculated | CVE-2020-25399 MISC |
| intermind — imind_server |
CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. | 2020-11-05 | not yet calculated | CVE-2020-25398 MISC |
| ipfs — ipfs |
An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes’ routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this. | 2020-11-02 | not yet calculated | CVE-2020-10937 MISC MISC |
| jenkins — active_directory_plugin |
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password. | 2020-11-04 | not yet calculated | CVE-2020-2299 MLIST CONFIRM |
| jenkins — active_directory_plugin |
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode. | 2020-11-04 | not yet calculated | CVE-2020-2301 CONFIRM |
| jenkins — active_directory_plugin |
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server. | 2020-11-04 | not yet calculated | CVE-2020-2300 MLIST CONFIRM |
| jenkins — active_subversion_plugin |
Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | 2020-11-04 | not yet calculated | CVE-2020-2304 MLIST CONFIRM |
| jenkins — ansible_plugin |
Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | 2020-11-04 | not yet calculated | CVE-2020-2310 CONFIRM |
| jenkins — appspider_plugin |
Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. | 2020-11-04 | not yet calculated | CVE-2020-2314 CONFIRM |
| jenkins — findbugs_plugin |
Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin’s post build step. | 2020-11-04 | not yet calculated | CVE-2020-2317 CONFIRM |
| jenkins — kubernetes_plugin |
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables. | 2020-11-04 | not yet calculated | CVE-2020-2307 CONFIRM |
| jenkins — mail_commander_plugin |
Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. | 2020-11-04 | not yet calculated | CVE-2020-2318 CONFIRM |
| jenkins — mercurial_plugin |
Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | 2020-11-04 | not yet calculated | CVE-2020-2305 CONFIRM |
| jenkins — sqlplus_script_runner_plugin |
Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs. | 2020-11-04 | not yet calculated | CVE-2020-2312 CONFIRM |
| jenkins — static_analysis_utilities_plugin |
Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | 2020-11-04 | not yet calculated | CVE-2020-2316 CONFIRM |
| jenkins — visualworks_store_plugin |
Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | 2020-11-04 | not yet calculated | CVE-2020-2315 CONFIRM |
| jenkins — vmware_lab_manager_slaves_plugin |
Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. | 2020-11-04 | not yet calculated | CVE-2020-2319 CONFIRM |
| joomla — jomsocial |
JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer’s profile. | 2020-11-04 | not yet calculated | CVE-2020-22274 MISC MISC MISC |
| joplin — joplin |
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. | 2020-11-06 | not yet calculated | CVE-2020-28249 MISC MISC |
| kuka — visual_components |
Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol is vulnerable to DoS through an arbitrary pointerderreference. This flaw allows an attacker to to pass a specially crafted package that, when processed by theservice, causes an arbitrary pointer from the stack to be dereferenced, causing an uncaught exception thatterminates the service. This can be further contructed in combination with RVDP#710 which exploits an informationdisclosure leak, or with RVDP#711 for an stack-overflow and potential code execution.Beyond denying simulations, Visual Components provides capabilities to interface with industrial machinery andautomate certain processes (e.g. testing, benchmarking, etc.) which depending on the DevOps setup might beintegrated into the industrial flow. Accordingly, a DoS in the simulation might have higher repercusions, dependingon the Industrial Control System (ICS) ICS infrastructure. | 2020-11-06 | not yet calculated | CVE-2020-10292 CONFIRM |
| kuka — visual_components |
Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol leaks information regarding the receiving serverinformation, license information and managing licenses, among others.Through this flaw, attackers can retreive information about a KUKA simulation system, particularly, the version ofthe licensing server, which is connected to the simulator, and which will allow them to launch local simulationswith similar characteristics, further understanding the dynamics of motion virtualization and opening doors toother attacks (see RVDP#711 and RVDP#712 for subsequent vulnerabilities that compromise integrity andavailability).Beyond compromising simulations, Visual Components provides capabilities to interface with industrial machinery.Particularly, their PLC Connectivity feature ‘makes it easy’ to connect simulations with control systems usingeither the industry standard OPC UA or other supported vendor specific interfaces. This fills the gap of jumpingfrom simulation to real and enables attackers to pivot from the Visual Components simulator to robots or otherIndustrial Control System (ICS) devices, such as PLCs. | 2020-11-06 | not yet calculated | CVE-2020-10291 CONFIRM |
| libmaxminddb — libmaxminddb |
libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c. | 2020-11-06 | not yet calculated | CVE-2020-28241 MISC MISC MISC |
| lightbend — play_framework |
In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input. | 2020-11-06 | not yet calculated | CVE-2020-26882 MISC MISC |
| lightbend — play_framework |
In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents. | 2020-11-06 | not yet calculated | CVE-2020-26883 MISC MISC |
| lightbend — play_framework |
An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a StackOverflowError and Denial of Service. | 2020-11-06 | not yet calculated | CVE-2020-27196 MISC MISC |
| linux — linux_kernel |
An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9. | 2020-11-06 | not yet calculated | CVE-2020-27152 MLIST MISC CONFIRM CONFIRM |
| linux — swift |
A stack overflow issue existed in Swift for Linux. The issue was addressed with improved input validation for dealing with deeply nested malicious JSON input. | 2020-11-02 | not yet calculated | CVE-2020-9861 MISC |
| marmind — marmind |
An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploaded by administrative users. The accessed files were not visible by the low privileged users in the web GUI. | 2020-11-05 | not yet calculated | CVE-2020-26506 MISC MISC |
| marmind — marmind |
A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into the “Description” field under the “Insert To-Do” option. Other users might download this data, for example a CSV file, and execute the malicious commands on their computer by opening the file using a software such as Microsoft Excel. The attacker could gain remote access to the user’s PC. | 2020-11-05 | not yet calculated | CVE-2020-26507 MISC MISC |
| microfocus — self_service_password_reset |
Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6 and 4.5.0.1 and 4.5.0.2. In certain configurations the vulnerability could disclose sensitive information. | 2020-11-05 | not yet calculated | CVE-2020-25837 MISC |
| misp-project — misp |
MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. | 2020-11-02 | not yet calculated | CVE-2020-28043 MISC |
| mit — kerberos5 |
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit. | 2020-11-06 | not yet calculated | CVE-2020-28196 CONFIRM MLIST FEDORA |
| mitsubishi_electric — gt14_model_of_got_1000_series | Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet. | 2020-11-06 | not yet calculated | CVE-2020-5649 MISC MISC MISC MISC |
| mitsubishi_electric — gt14_model_of_got_1000_series |
Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet. | 2020-11-06 | not yet calculated | CVE-2020-5647 MISC MISC MISC MISC |
| mitsubishi_electric — gt14_model_of_got_1000_series |
Improper neutralization of argument delimiters in a command (‘Argument Injection’) vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet. | 2020-11-06 | not yet calculated | CVE-2020-5648 MISC MISC MISC MISC |
| mitsubishi_electric — gt14_model_of_got_1000_series |
NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet. | 2020-11-06 | not yet calculated | CVE-2020-5646 MISC MISC MISC MISC |
| mitsubishi_electric — gt14_model_of_got_1000_series |
Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet. | 2020-11-06 | not yet calculated | CVE-2020-5644 MISC MISC MISC MISC |
| mitsubishi_electric — gt14_model_of_got_1000_series |
Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet. | 2020-11-06 | not yet calculated | CVE-2020-5645 MISC MISC MISC MISC |
| mitsubishi_electric — melsec_iq |
Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 CPU firmware versions ’20’ and earlier, R 04/08/16/32/120 (EN) CPU firmware versions ’52’ and earlier, R 08/16/32/120 SFCPU firmware versions ’22’ and earlier, R 08/16/32/120 PCPU all versions, R 08/16/32/120 PSFCPU all versions, R 16/32/64 MTCPU all versions, Q03 UDECPU, Q 04/06/10/13/20/26/50/100 UDEHCPU serial number ‘22081’ and earlier , Q 03/04/06/13/26 UDVCPU serial number ‘22031’ and earlier, Q 04/06/13/26 UDPVCPU serial number ‘22031’ and earlier, Q 172/173 DCPU all versions, Q 172/173 DSCPU all versions, Q 170 MCPU all versions, Q 170 MSCPU all versions, L 02/06/26 CPU (-P) and L 26 CPU – (P) BT all versions) allows a remote unauthenticated attacker to stop the Ethernet communication functions of the products via a specially crafted packet, which may lead to a denial of service (DoS) condition . | 2020-11-02 | not yet calculated | CVE-2020-5652 MISC MISC MISC |
| mitsubishi_electric — melsec_iq-r_series | Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are ’02’ or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are ’01’ or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are ’08’ or before, RD81MES96N MES Interface Module First 2 digits of serial number are ’04’ or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are ’04’ or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet. | 2020-11-02 | not yet calculated | CVE-2020-5658 MISC MISC MISC |
| mitsubishi_electric — melsec_iq-r_series | Improper neutralization of argument delimiters in a command (‘Argument Injection’) vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are ’02’ or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are ’01’ or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are ’08’ or before, RD81MES96N MES Interface Module First 2 digits of serial number are ’04’ or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are ’04’ or before) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet. | 2020-11-02 | not yet calculated | CVE-2020-5657 MISC MISC MISC |
| mitsubishi_electric — melsec_iq-r_series |
NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are ’02’ or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are ’01’ or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are ’08’ or before, RD81MES96N MES Interface Module First 2 digits of serial number are ’04’ or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are ’04’ or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet. | 2020-11-02 | not yet calculated | CVE-2020-5655 MISC MISC MISC |
| mitsubishi_electric — melsec_iq-r_series |
Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are ’02’ or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are ’01’ or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are ’08’ or before, RD81MES96N MES Interface Module First 2 digits of serial number are ’04’ or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are ’04’ or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet. | 2020-11-02 | not yet calculated | CVE-2020-5656 MISC MISC MISC |
| mitsubishi_electric — melsec_iq-r_series |
Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are ’02’ or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are ’01’ or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are ’08’ or before, RD81MES96N MES Interface Module First 2 digits of serial number are ’04’ or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are ’04’ or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet. | 2020-11-02 | not yet calculated | CVE-2020-5654 MISC MISC MISC |
| mitsubishi_electric — melsec_iq-r_series |
Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are ’02’ or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are ’01’ or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are ’08’ or before, RD81MES96N MES Interface Module First 2 digits of serial number are ’04’ or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are ’04’ or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet. | 2020-11-02 | not yet calculated | CVE-2020-5653 MISC MISC MISC |
| moxa — mxview |
An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality. | 2020-11-05 | not yet calculated | CVE-2020-13536 MISC |
| moxa — mxview |
An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary.By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality and among them the mosquitto executable is also run. | 2020-11-05 | not yet calculated | CVE-2020-13537 MISC |
| moxa — vport_461_firmware |
A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary commands in Moxa’s VPort 461 Series Industrial Video Servers. | 2020-11-02 | not yet calculated | CVE-2020-23639 MISC |
| nats — jwt_library |
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. | 2020-11-06 | not yet calculated | CVE-2020-26892 MISC CONFIRM |
| nats — jwt_library |
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). | 2020-11-06 | not yet calculated | CVE-2020-26521 CONFIRM MISC |
| neoflex — video_subscritpion_system |
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website’s Settings to be changed (such as Payment Settings) | 2020-11-04 | not yet calculated | CVE-2020-22273 MISC MISC |
| nessus — nessus_for_windows_and_nessus_agent | A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability. | 2020-11-05 | not yet calculated | CVE-2020-5793 MISC MISC |
| nessus — network_monitor |
A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability. | 2020-11-06 | not yet calculated | CVE-2020-5794 MISC |
| netapp — santricity_os_controller_software |
SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker with access to the system to cause a Denial of Service (DoS). | 2020-11-06 | not yet calculated | CVE-2020-8580 MISC |
| netapp — santricity_os_controller_software |
SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session. | 2020-11-06 | not yet calculated | CVE-2020-8577 MISC |
| netgear — nighthawk_r7000_devices |
The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim’s intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs because the ALG takes action based on an IP packet with an initial REGISTER substring in the TCP data, and the correct intranet IP address in the subsequent Via header, without properly considering that connection progress and fragmentation affect the meaning of the packet data. | 2020-11-02 | not yet calculated | CVE-2020-28041 MISC MISC MISC MISC |
| nextcloud — nextcloud_server |
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it. | 2020-11-02 | not yet calculated | CVE-2020-8236 MISC MISC |
| nextcloud — nextcloud_server |
A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call. | 2020-11-02 | not yet calculated | CVE-2020-8183 MISC MISC |
| nextcloud — nextcloud_server |
A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended. | 2020-11-02 | not yet calculated | CVE-2020-8173 MISC MISC |
| openfind — mailgates_and_mailaudit |
MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameter after attackers obtain the user’s access token. | 2020-11-01 | not yet calculated | CVE-2020-25849 CONFIRM |
| opensuse — opesuse |
An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that – for a short time period – allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server display contents and, for example, intercept keystrokes or access the clipboard. This is caused by a race condition during Xauthority file creation. | 2020-11-04 | not yet calculated | CVE-2020-28049 SUSE MISC MISC MISC MLIST DEBIAN |
| oracle — weblogic_server |
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | 2020-11-02 | not yet calculated | CVE-2020-14750 MISC |
| origin — origin_client |
A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators. | 2020-11-02 | not yet calculated | CVE-2020-27708 MISC |
| origin — origin_client |
A cross-site scripting (XSS) vulnerability exists in the Origin Client that could allow a remote attacker to execute arbitrary Javascript in a target user’s Origin client. An attacker could use this vulnerability to access sensitive data related to the target user’s Origin account, or to control or monitor the Origin text chat window. | 2020-11-02 | not yet calculated | CVE-2020-15914 MISC |
| osticket — osticket |
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. | 2020-11-02 | not yet calculated | CVE-2020-24881 MISC MISC |
| pax — point_of_sale_device |
An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in management mode, enable the XCB service, and then list, read, create, and overwrite files with MAINAPP permissions. | 2020-11-02 | not yet calculated | CVE-2020-28044 MISC |
| pax — prolinos |
An issue was discovered in ProlinOS through 2.4.161.8859R. An attacker with local code execution privileges as a normal user (MAINAPP) can escalate to root privileges by exploiting the setuid installation of the xtables-multi binary and leveraging the ip6tables –modprobe switch. | 2020-11-02 | not yet calculated | CVE-2020-28046 MISC |
| pax — prolinos |
An unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R. This OS requires installed applications and all system binaries to be signed either by the manufacturer or by the Point Of Sale application developer and distributor. The signature is a 2048-byte RSA signature verified in the kernel prior to ELF execution. Shared libraries, however, do not need to be signed, and they are not verified. An attacker may execute a custom binary by compiling it as a shared object and loading it via LD_PRELOAD. | 2020-11-02 | not yet calculated | CVE-2020-28045 MISC |
| qemu — qemu | ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process. | 2020-11-06 | not yet calculated | CVE-2020-27616 CONFIRM MISC |
| qemu — qemu |
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol. | 2020-11-06 | not yet calculated | CVE-2020-27617 CONFIRM MISC |
| qualcomm — multiple_snapdragon_products |
u’Third-party app may also call the broadcasts in Perfdump and cause privilege escalation issue due to improper access control’ in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8909W, MSM8917, MSM8940, Nicobar, QCA6390, QCM2150, QCS605, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429W, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 | 2020-11-02 | not yet calculated | CVE-2020-11164 CONFIRM |
| qualcomm — multiple_snapdragon_products |
u’Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MSM8917, MSM8953, Nicobar, QCA6390, QCM2150, QCS404, QCS405, QCS605, QM215, QRB5165, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 | 2020-11-02 | not yet calculated | CVE-2020-11162 CONFIRM |
| qualcomm — multiple_snapdragon_products |
u’Bluetooth devices does not properly restrict the L2CAP payload length allowing users in radio range to cause a buffer overflow via a crafted Link Layer packet(Equivalent to CVE-2019-17060,CVE-2019-17061 and CVE-2019-17517 in Sweyntooth paper)’ in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music in AR9344 | 2020-11-02 | not yet calculated | CVE-2020-11114 CONFIRM |
| red_hat — red_hat |
A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel’s Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. | 2020-11-05 | not yet calculated | CVE-2020-25662 CONFIRM CONFIRM CONFIRM |
| red_hat — red_hat |
A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel’s Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. | 2020-11-05 | not yet calculated | CVE-2020-25661 CONFIRM CONFIRM CONFIRM |
| redcap — redcap |
An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger’s CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another’s conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}. | 2020-11-02 | not yet calculated | CVE-2020-27358 MISC MISC MISC |
| relish — verve_connect_vh510_devices | The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings. | 2020-11-04 | not yet calculated | CVE-2020-27691 MISC MISC |
| relish — verve_connect_vh510_devices |
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings (responsible for managing devices remotely). This makes it possible to remotely reboot the device or upload malicious firmware. | 2020-11-04 | not yet calculated | CVE-2020-27692 MISC MISC |
| relish — verve_connect_vh510_devices |
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on the device, as well as upgrade the firmware image to a malicious version. | 2020-11-04 | not yet calculated | CVE-2020-27689 MISC MISC |
| relish — verve_connect_vh510_devices |
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. When a POST request is sent to /boaform/admin/formDOMAINBLK with a large blkDomain value, the Boa server crashes. | 2020-11-04 | not yet calculated | CVE-2020-27690 MISC MISC |
| rvtools — rvtools |
RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances. | 2020-11-05 | not yet calculated | CVE-2020-27688 MISC MISC |
| saltstack — salt |
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. | 2020-11-06 | not yet calculated | CVE-2020-25592 SUSE MISC FEDORA CONFIRM |
| saltstack — salt |
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. | 2020-11-06 | not yet calculated | CVE-2020-16846 SUSE MISC FEDORA CONFIRM |
| saltstack — salt |
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. | 2020-11-06 | not yet calculated | CVE-2020-17490 SUSE MISC FEDORA CONFIRM |
| servicestack — servicestack |
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature. | 2020-11-02 | not yet calculated | CVE-2020-28042 MISC MISC MISC MISC |
| shun_hu_technology — juuko_k-800 |
JUUKO K-800 (Firmware versions prior to numbers ending …9A, …9B, …9C, etc.) is vulnerable to a replay attack and command forgery, which could allow attackers to replay commands, control the device, view commands, or cause the device to stop running. | 2020-11-02 | not yet calculated | CVE-2018-17932 MISC |
| shun_hu_technology — juuko_k-800 |
In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to numbers ending …9A, …9B, …9C, etc.). | 2020-11-02 | not yet calculated | CVE-2018-19025 MISC |
| silver_peak — unity_orchestrator |
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API. | 2020-11-05 | not yet calculated | CVE-2020-12146 MISC |
| silver_peak — unity_orchestrator |
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing. | 2020-11-05 | not yet calculated | CVE-2020-12147 MISC |
| silver_peak — unity_orchestrator |
Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability. | 2020-11-05 | not yet calculated | CVE-2020-12145 MISC |
| sonarqube — sonarqube |
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint. | 2020-11-02 | not yet calculated | CVE-2020-28002 MISC |
| studyplus — studyplus_app |
Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app. | 2020-11-06 | not yet calculated | CVE-2020-5667 MISC |
| suitecrm — suitecrm |
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root. | 2020-11-06 | not yet calculated | CVE-2020-28328 MISC MISC |
| synk — absolunet/kafe |
This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails. | 2020-11-05 | not yet calculated | CVE-2020-7761 MISC MISC |
| synk — browerless-chrome |
This affects all versions of package browserless-chrome. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server. | 2020-11-02 | not yet calculated | CVE-2020-7758 MISC MISC MISC |
| synk — codemirror |
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)* | 2020-10-30 | not yet calculated | CVE-2020-7760 CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM |
| synk — droppy |
This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server. | 2020-11-02 | not yet calculated | CVE-2020-7757 MISC MISC |
| synk — jsreport-chrome-pdf |
This affects the package jsreport-chrome-pdf before 1.10.0. | 2020-11-05 | not yet calculated | CVE-2020-7762 MISC MISC |
| synk — phantom-html-to-pdf |
This affects the package phantom-html-to-pdf before 0.6.1. | 2020-11-05 | not yet calculated | CVE-2020-7763 MISC MISC |
| synopsys — blackduck |
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 – 0.0.52 does not validate SSL certificates in certain cases. | 2020-11-06 | not yet calculated | CVE-2020-27589 MISC MISC MISC MISC |
| tcpdump — tcpdump |
The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. | 2020-11-04 | not yet calculated | CVE-2020-8037 MISC |
| tcpdump — tcpdump |
The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way. | 2020-11-04 | not yet calculated | CVE-2020-8036 MISC |
| teler — teler |
In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn’t get process ID and process group ID of teler properly to kills. The issue is patched in teler 0.0.1 and 0.0.1-dev5.1. | 2020-11-06 | not yet calculated | CVE-2020-26213 MISC CONFIRM |
| telerik — fiddler |
Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, followed by –utility-and-browser –utility-cmd-prefix= and the pathname of a locally installed program. The victim must interactively choose the Open On Browser option. Fixed in version 5.0.20204. | 2020-11-05 | not yet calculated | CVE-2020-13661 MISC MISC MISC |
| tmux — tmux |
The function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output. | 2020-11-06 | not yet calculated | CVE-2020-27347 MISC MISC |
| ubiquiti — unifi_protect_controller |
A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect v1.14.11 and newer.This issue does not impact UniFi Cloud Key Gen 2 plus.This issue does not impact UDM-Pro customers with UniFi Protect stopped.Affected Products:UDM-Pro firmware 1.7.2 and earlier.UNVR firmware 1.3.12 and earlier.Mitigation:Update UniFi Protect to v1.14.11 or newer version; the UniFi Protect controller can be updated through your UniFi OS settings.Alternatively, you can update UNVR and UDM-Pro to:- UNVR firmware to 1.3.15 or newer.- UDM-Pro firmware to 1.8.0 or newer. | 2020-11-05 | not yet calculated | CVE-2020-8267 MISC MISC MISC |
| ubuntu — libvirt |
Ubuntu’s packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code. | 2020-11-06 | not yet calculated | CVE-2020-15708 MISC |
| ubuntu — packagekit |
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own. | 2020-11-07 | not yet calculated | CVE-2020-16121 CONFIRM MISC |
| ubuntu — packagekit |
PackageKit’s apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages. | 2020-11-07 | not yet calculated | CVE-2020-16122 CONFIRM |
| ubuntu — ubuntu |
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root. | 2020-10-31 | not yet calculated | CVE-2020-15703 CONFIRM MISC |
| unix — symbolic_link |
UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)_V5_200721 allows an authenticated admin user, with physical access and network access, to execute arbitrary code after plugging a crafted USB drive into the router. | 2020-11-06 | not yet calculated | CVE-2020-5795 MISC |
| vmware — tanzu |
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity providers, one can acquire the token of the other and thus operate with their permissions. Note: Foundation may be vulnerable only if: 1) The system zone is set up to use a SAML identity provider 2) There are internal users that have the same username as users in the external SAML provider 3) Those duplicate-named users have the scope to access the SSO operator dashboard 4) The vulnerability doesn’t appear with LDAP because of chained authentication. | 2020-10-31 | not yet calculated | CVE-2020-5425 CONFIRM |
| whatsapp — whatsapp_and_whatsapp_business |
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked. | 2020-11-03 | not yet calculated | CVE-2020-1908 CONFIRM |
| wildfly — wildfly |
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability. | 2020-11-02 | not yet calculated | CVE-2020-25689 CONFIRM |
| wireshark — wireshark |
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement. | 2020-11-02 | not yet calculated | CVE-2020-28030 MISC MISC MISC |
| wondershare — dr.fone |
Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%Wondersharedr.foneLibraryDriverInstaller has Full Control for BUILTINUsers. | 2020-11-02 | not yet calculated | CVE-2020-27992 MISC MISC |
| wordpress — wordpress | Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer’s profile. | 2020-11-04 | not yet calculated | CVE-2020-22277 MISC MISC MISC |
| wordpress — wordpress |
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain. | 2020-11-07 | not yet calculated | CVE-2020-28339 MISC MISC |
| wordpress — wordpress |
WeForms WordPress Plugin 1.4.7 allows CSV injection via a form’s entry. | 2020-11-04 | not yet calculated | CVE-2020-22276 MISC MISC |
| wordpress — wordpress |
Easy Registration Forms (ER Forms) WordPress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable. | 2020-11-04 | not yet calculated | CVE-2020-22275 MISC MISC |
This product is provided subject to this Notification and this Privacy & Use policy.