CVE-2020-13260

A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as th...

Cross site scripting

A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as th...

CVE-2020-13260

The CVE-2020-13260 entry concerns RAD SecFlow-1v web-based management interface (SF_0290_2.3.01.26). A vulnerability allows an authenticated attacker to upload a JavaScript file as a stored XSS payload, which is saved in the system as an OVPN config or a static key file. The payload executes when...

CVE-2020-13260

A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as th...

CVE-2020-13260: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as th...

PT-2020-13401

Name of the Vulnerable Software and Affected Versions RAD SecFlow-1v versions through 2020-05-21 Description A stored XSS issue exists in the web-based management interface, allowing an authenticated attacker to upload a JavaScript file with a malicious payload. This payload remains stored in the...

CVE-2020-1968

A flaw was found in openssl in versions 1.0.2 to 1.0.2w. A Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman DH based ciphersuite. In such a case this would result in th...

FreeBSD : Mbed TLS -- Local side channel attack on RSA and static Diffie-Hellman (bcdeb6d2-f02d-11ea-838a-0011d823eebd)

Manuel Pegourie-Gonnard reports : An attacker with access to precise enough timing and memory access information typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world can recover the private keys used in RSA or static finite-field...

Outdated Static Dependency in vue-moment

Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a dependency that can be updated. It has [email protected] that contains a Regular Expression Denial of Service vulnerability. Recommendation Upgrade t...

GHSA-HRPP-F84W-XHFG Outdated Static Dependency in vue-moment

Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a dependency that can be updated. It has [email protected] that contains a Regular Expression Denial of Service vulnerability. Recommendation Upgrade t...

futures_task::waker may cause a use-after-free if used on a type that isn't 'static

Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake is called after original data had been dropped. The flaw was corrected by adding 'static lifetime bound to the data waker takes...

RUSTSEC-2020-0060 futures_task::waker may cause a use-after-free if used on a type that isn't 'static

Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake is called after original data had been dropped. The flaw was corrected by adding 'static lifetime bound to the data waker takes...

PT-2020-17538

Name of the Vulnerable Software and Affected Versions futures-task crate versions prior to 0.3.6 Description An issue in the futures-task crate may cause a use-after-free in certain situations. The problem arises when the Waker::wake function is called after the original data has been dropped, du...

Server-side Request Forgery (SSRF)

Overview osm-static-maps is a Create a static image of a map with the features you want Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an...

Path Traversal in file-static-server

All versions of file-static-server are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative module until a fix is mad...

GHSA-QJFH-XC44-RM9X Path Traversal in file-static-server

All versions of file-static-server are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative module until a fix is mad...

Directory Traversal

static-server-gx is vulnerable to directory traversal. The vulnerability exists as it does not validate the file path for input such as ../, allowing the escape from the target root directory...

PT-2020-21462

Name of the Vulnerable Software and Affected Versions file-static-server versions all versions Description The issue is related to Path Traversal due to insufficient input sanitization in URLs. Attackers can access server files by using relative paths when fetching files. Recommendations For all...

confluence-static-site-builder (>=1.0.0-m04, <=1.0.0-m08) potentially affected by unknown CVE via commnader (0.0.1-security)

commnader NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on commnader and may be impacted: - confluence-static-site-builder =1.0.0-m04, =1.0.0-m08 Source cves: unknown CVE Source advisory: OSV:GHSA-855M-JCHH-9QJC...

Sandbox Breakout / Arbitrary Code Execution in static-eval

Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept var evaluate = require'static-eval'; var parse = require'esprima'.parse;...