Race Condition

Overview Affected versions of this package are vulnerable to Race Condition. An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive...

PT-2020-14347 · Wolfssl · Wolfssl

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 4.5.0 Description: An issue allows local attackers to conduct a cache-timing attack against public key operations. This could potentially expose sensitive information if the affected system has been used for private...

CVE-2020-17487

radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY...

CVE-2020-17487

radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY...

CVE-2020-17487

radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in rx509parsealgorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGEDIRECTORYENTRYSECURITY...

Directory traversal

In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current...

Default credentials

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited...

CVE-2020-6165

CVE-2020-6165 affects SilverStripe 4.5.0 (notably silverstripe/recipe-cms). The root cause is an incomplete permission check in the silverstripe/graphql module that can allow authenticated users to read records that should be excluded from results, particularly when lists are limited (e.g., by pa...

PT-2020-18975 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe version 4.5.0 Description: The issue allows attackers to read certain records that should not have been placed into a result set. This is due to the automatic permission-checking mechanism in the silverstripe/graphql module not...

LeptonCMS Cross-Site Scripting Vulnerability (CNVD-2020-35505)

LeptonCMS is a content management system CMS for the Lepton Project. A cross-site scripting vulnerability exists in the modules/wysiwyg/save.php file in LeptonCMS version 4.5.0. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

CVE-2020-12707

An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements...

Openfire 4.3.x < 4.5.0 Multiple XSS Vulnerabilities

Openfire is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-19490

CVE-2019-19490 affects LiteManager 4.5.0, where the LiteManagerFree - Server folder exposes weak permissions (Everyone: Full Control) in ROMFUSClient.exe, enabling local privilege implications. Root cause: overly permissive access on the server folder. Impact as documented: potential elevation of...

LiteManager Insecure File Permissions Vulnerability

LiteManager is a lightweight remote control software. A security vulnerability exists in LiteManager version 4.5.0. An attacker can exploit the vulnerability to elevate privileges...

TYPO3 SQL Injection Vulnerability (CNVD-2019-47027)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A SQL injection vulnerability exists in Typo3 versions 4.5.0 through 4.5.5. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...

Samba AD DC Check Password Script Weakness (CVE-2019-14833)

When the password contains multi-byte non-ASCII characters, the check password script of Samba AD DC does not receive the full password string. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective righ...

LiteManager 4.5.0 - (romservice) Unquoted Serive Path Vulnerability

Exploit Title : LiteManager 4.5.0 - 'romservice' Unquoted Serive Path Exploit Author : Cakes Vendor: LiteManager Team Version : LiteManager 4.5.0 Software: http://html.tucows.com/preview/1594042/LiteManager-Free?q=remote+support Tested on Windows 10 CVE : N/A c:\sc qc romservice SC...

PT-2019-5531 · Ignite Realtime · Openfire

Name of the Vulnerable Software and Affected Versions: Openfire versions through 4.4.2 Description: A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests,...

libvirt security, bug fix, and enhancement update

4.5.0-23 - api: disallow virDomainSaveImageGetXMLDesc on read-only connections CVE-2019-10161 - api: disallow virDomainManagedSaveDefineXML on read-only connections CVE-2019-10166 - api: disallow virConnectGetDomainCapabilities on read-only connections CVE-2019-10167 - api: disallow...

Opengear console server cross-site scripting vulnerability

Opengear console server is a console server from Opengear USA. It is capable of managing network, server, and power infrastructures with monitoring, troubleshooting, and remediation features. A cross-site scripting vulnerability exists in the Opengear console server using firmware versions prior ...