Photon OS 2.0: Nodejs PHSA-2020-2.0-0269

An update of the nodejs package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0269. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid13951...

CVE-2020-15058

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic...

Cross site scripting

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name...

Authentication flaw

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter...

CVE-2020-15060

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name...

CVE-2020-15060

The Lindy 42633 4-Port USB 2.0 Gigabit Network Server (firmware 2.078.000) has a persistent cross-site scripting (XSS) vulnerability. An attacker on the same network can exploit it by leveraging administrative privileges to set a crafted server name, enabling persistent XSS. The root cause is rel...

CVE-2020-15059

The CVE-2020-15059 entry concerns Lindy 42633 4-Port USB 2.0 Gigabit Network Server (firmware 2.078.000). The vulnerability enables authentication bypass via a web administration request that omits a password parameter, allowing an attacker on the same network to access privileged functions. Affe...

CVE-2020-15059

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter...

PT-2020-19567 · Gog · Gog Galaxy

Name of the Vulnerable Software and Affected Versions: GOG Galaxy versions 1.2.x through 1.2.64 GOG Galaxy versions 2.0.x through 2.0.12 Description: The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with an...

Hyperledger: Vulnerabilities in Endorsement Mechanism of Private Data Related Transactions in Hyperledger Fabric 2.0

To whom it may concern, We report design flaws that can be exploited by private data collection non-member organizations to forge endorsements of read-related transactions and return fake values to a user. When a user issues a read-only transaction proposal to a endorser in the private data...

WordPress FoodBakery premium theme <= 1.9 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Vlad Vector in WordPress FoodBakery premium theme versions = 1.9. Solution Update the WordPress FoodBakery premium theme to the latest available version at least 2.0...

Elegant Themes (Divi 3.0 - 4.5.2, Extra 2.0 - 4.5.2, Divi Builder 2.0 - 4.5.2) - Authenticated Arbitrary File Upload

Description This flaw gave authenticated attackers, with contributor-level or above capabilities, the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server. Usage: php poc.php url username password filetoupload Once the file is...

Photon OS 2.0: Grub2 PHSA-2020-2.0-0267

An update of the grub2 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0267. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139243...

openSUSE: Security Advisory for claws-mail (openSUSE-SU-2020:1116-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

EulerOS 2.0 SP8 : nghttp2 (EulerOS-SA-2020-1815)

According to the version of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a...

EulerOS 2.0 SP8 : curl (EulerOS-SA-2020-1796)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - curl can be tricked my a malicious server to overwrite a local file when using -J --remote-header-name and -i --head in the same command...

EulerOS 2.0 SP8 : ant (EulerOS-SA-2020-1794)

According to the version of the ant packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several...

EulerOS 2.0 SP8 : perl (EulerOS-SA-2020-1820)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Perl before 5.30.3 has an integer overflow related to mishandling of a 'PLregkindOPn == NOTHING' situation. A crafted regular expression could lea...

EulerOS 2.0 SP8 : python-ecdsa (EulerOS-SA-2020-1824)

According to the version of the python-ecdsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-1804)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, becau...