92455 matches found
CVE-2020-10489
CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a ticket via a crafted request...
CVE-2020-10014
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to break out of its sandbox...
CVE-2020-10238
An issue was discovered in Joomla! before 3.9.16. Various actions in comtemplates lack the required ACL checks, leading to various potential attack vectors...
CVE-2020-10867
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service AvastSvc.exe allows attackers to bypass intended access restrictions on tasks from an untrusted process, when Self Defense is enabled...
CVE-2020-10670
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version...
CVE-2020-10849
An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 Exynos7885, Exynos8895, and Exynos9810 chipsets software. The Gatekeeper trustlet allows a brute-force attack on the screen lock password. The Samsung ID is SVE-2019-14575 January 2020...
CVE-2020-10850
An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 Exynos chipsets software. The secure bootloade has a buffer overflow of the USB buffer, leading to arbitrary code execution. The Samsung ID is SVE-2019-15872 January 2020...
CVE-2020-10832
An issue was discovered on Samsung mobile devices with P9.0 Exynos chipsets software. Kernel Wi-Fi drivers allow out-of-bounds Read or Write operations e.g., a buffer overflow. The Samsung IDs are SVE-2019-16125, SVE-2019-16134, SVE-2019-16158, SVE-2019-16159, SVE-2019-16319, SVE-2019-16320,...
CVE-2020-10535
GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address...
CVE-2020-10634
SAE IT-systems FW-50 Remote Telemetry Unit RTU. A specially crafted request could allow an attacker to view the file structure of the affected device and access files that should be inaccessible...
CVE-2020-10454
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/sitemap-generator.php by adding a question mark ? followed by the payload...
CVE-2020-10256
An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to...
CVE-2020-10571
An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data...
CVE-2020-10418
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-attachments.php by adding a question mark ? followed by the payload...
CVE-2020-10625
WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...
CVE-2020-10580
A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management ADM through 5.0 allows remote authenticated attackers to execute arbitrary PHP code on the server as the user running the application...
CVE-2020-10427
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-languages.php by adding a question mark ? followed by the payload...
CVE-2020-10364
The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management...
CVE-2020-10049
A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V2.10.2. The start-stop scripts for the services of the affected application could allow a local attacker to include arbitrary commands that are executed when services are started or stopped interactively by system...