JVN#94169589: Multiple vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Denial-of-service DoS due to improper verification of input values CWE-400 - CVE-2020-5682 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS v2|...

CVE-2020-7535

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' Vulnerability Type vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions,...

Path traversal

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' Vulnerability Type vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions,...

CVE-2020-7535

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' Vulnerability Type vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions,...

CVE-2020-7535

CVE-2020-7535 describes a CWE-22 path traversal vulnerability in the Web Server of Schneider Electric Modicon M340, including Legacy Offers Modicon Quantum and Modicon Premium and related Communication Modules. The Red Hat/NVD entries and vendor advisories reiterate that sending a specially craft...

CVE-2018-19665 affecting package qemu-kvm 4.2.0-22

CVE-2018-19665 affecting package qemu-kvm 4.2.0-22. A patched version of the package is available...

Directory traversal in development mode handler in Vaadin 14 and 15-17

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder. See CWE-20: Improper...

SSL VPN : Intranet Applications connectivity break on port 3389 and port 22 after upgrade

After Update to 64.35 the SSL Client send TCP FIN ACK to the Server. This problem is not reported on 13.0.58.32, 13.0.61.48. There is no issue with accessing the Intranet Applications. 13.0.64.35, and 13.0.67.39, the connectivity to port 3389 and port 22 breaks...

CVE-2020-28333

creationtimestamp| type| source ---|---|--- 2020-11-24 22:47:02+00:00| seen| https://t.me/cibsecurity/16812...

CVE-2020-28348

creationtimestamp| type| source ---|---|--- 2020-11-24 07:46:22+00:00| seen| https://t.me/cibsecurity/16764...

CVE-2020-24365

creationtimestamp| type| source ---|---|--- 2020-11-22 20:12:43+00:00| published-proof-of-concept| https://t.me/cKure/2937...

WordPress Multiple Plugins / Themes Directory Traversal / File Download Vulnerability (HTTP)

Multiple WordPress Plugins / Themes are prone to a directory traversal or file download vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2020-0449

creationtimestamp| type| source ---|---|--- 2020-11-10 16:27:22+00:00| seen| https://t.me/cibsecurity/16070...

Amazon Linux 2 : libsndfile (ALAS-2020-1529)

The version of libsndfile installed on the remote host is prior to 1.0.25-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1529 advisory. An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alawarray in alaw.c that will lead...

horacius.com Cross Site Scripting vulnerability OBB-1442553

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-9990

creationtimestamp| type| source ---|---|--- 2020-10-22 22:52:11+00:00| seen| https://t.me/cibsecurity/15536...

CVE-2020-9900

creationtimestamp| type| source ---|---|--- 2020-10-22 22:52:09+00:00| seen| https://t.me/cibsecurity/15535 2026-07-29 12:02:58+00:00| seen| https://t.me/reverseame/1110 2026-07-30 00:02:48+00:00| seen| https://t.me/reverseame/1110 2026-08-03 11:06:34+00:00| published-proof-of-concept|...

CVE-2020-27664

creationtimestamp| type| source ---|---|--- 2020-10-22 22:52:08+00:00| seen| https://t.me/cibsecurity/15534...

villefer.com.br Cross Site Scripting vulnerability OBB-1437326

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

meiemaa.ee Cross Site Scripting vulnerability OBB-1437291

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...