Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the lib/utils.js file, which is required by main entry of the package. Note: CVE-2020-28432 has been retracted because it was found to be invalid. Further investigatio...

UBUNTU-CVE-2020-35132

An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via getrequest in lib/function.php...

CVE-2020-35132: Improper Neutralization of Input During Web Page Generation

An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via getrequest in lib/function.php...

CVE-2020-35149: Undefined Security Weakness

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-28938

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users...

OpenClinic Cross-Site Scripting Vulnerability

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A cross-site scripting vulnerability exists in OpenClinic version 0.8.2, which stems from the effects of an XSS vulnerability stored in...

CVE-2020-28938: Improper Neutralization of Input During Web Page Generation

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users...

CVE-2020-28977: Server-Side Request Forgery (SSRF)

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/get.php?subdomain=SSRF...

Denial Of Service

krb5is vulnerable to denial of service. The vulnerability exists because lib/krb5/asn.1/asn1encode.c support for indefinite length allows for an unbounded recursion...

CVE-2020-13638: Improper Privilege Management

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7...

Server side request forgery (ssrf)

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...

In Python 3 through 3.9.0 the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

...

CVE-2020-24063: Server-Side Request Forgery (SSRF)

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...

Arbitrary File Read

jsreport-chrome-pdf is vulnerable to arbitrary file read. An attacker can send malicious requests via lib/conversion.js to read arbitrary local files...

EulerOS Virtualization 3.0.6.6 : python-ipaddress (EulerOS-SA-2020-2472)

According to the version of the python-ipaddress package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,...

Arbitrary File Read

Overview jsreport-chrome-pdf is a Affected versions of this package are vulnerable to Arbitrary File Read. An Arbitrary File Read vulnerability exists in lib/conversion.js. PoC document.writewindow.location='../../../../../etc/passwd' Remediation Upgrade jsreport-chrome-pdf to version 1.10.0 or...

Huawei EulerOS: Security Advisory for python (EulerOS-SA-2020-2471)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

new module: perl:5.30

An update is available for perl-Pod-Perldoc, perl-DBI, perl-Pod-Escapes, perl-Devel-PPPort, perl-Pod-Usage, perl-Sub-Exporter, perl-perlfaq, perl-Object-HashBase, perl-CPAN-Meta-YAML, perl-Digest, perl-podlators, perl-bignum, perl-Text-ParseWords, perl-Text-Template, perl-DBD-MySQL, perl-Text-Glo...

openSUSE Security Update : samba (openSUSE-2020-1819)

This update for samba fixes the following issues : Update to samba 4.11.14 - CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records bsc1177613. - CVE-2020-14323: Unprivileged user can crash winbind bsc1173994. - CVE-2020-14318: Missing permissions check in...

EulerOS 2.0 SP9 : python-ipaddress (EulerOS-SA-2020-2420)

According to the version of the python-ipaddress package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow...