CVE-2021-26090

CVE-2021-26090 describes a memory leak (CWE-401) in FortiMail Webmail that can allow an unauthenticated remote attacker to exhaust memory via specially crafted login requests. The vulnerability affects FortiMail Webmail components, with impact described as partial availability impact at the NVD m...

PT-2021-18635

Name of the Vulnerable Software and Affected Versions Sidekiq versions 5.1.3 and earlier Sidekiq versions 6.x through 6.2.0 Description The issue allows for XSS via the queue name of the live-poll feature, specifically when Internet Explorer is used. Recommendations For Sidekiq versions 5.1.3 and...

UBUNTU-CVE-2021-3470

A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use...

Elastic X-Pack Security SAML Vulnerability (ESA-2018-07)

Elastic X-Pack Security is prone to a vulnerability in the SAML implementation. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2020-6439

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.0 through 6.0.9 FortiOS versions 6.2.0 through 6.2.3 FortiOS version 6.4.0 Description An improper authentication issue exists in the SSL VPN functionality of FortiOS. This allows attackers to bypass two-factor...

CVE-2019-17655

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...

CVE-2019-15709

An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI...

Ubiquiti Networks AirOS Cross-Site Request Forgery Vulnerability

Ubiquiti Networks AirOS is a suite of operating systems for Ubiquiti network devices from Ubiquiti Networks. A cross-site request forgery vulnerability exists in Ubiquiti Networks AirMax AirOS TI, XW, and XM boards using firmware version 6.2.0 and earlier. An attacker could exploit this...

CVE-2019-6696

An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage...

CVE-2019-17654

An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking CSWSH attack...

Cross site scripting

An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking CSWSH attack...

CVE-2019-16156

CVE-2019-16156 affects Fortinet FortiWeb 6.0.5, 6.2.0 and 6.1.1, where an Improper Neutralization of Input in the Anomaly Detection Parameter/Interface can enable a remote unauthenticated attacker to perform a Cross Site Scripting (XSS) attack. The linked connected documents confirm the root caus...

PT-2020-20269 · Alfresco · Alfresco Community +1

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise versions prior to 5.2.7 Alfresco Community versions prior to 6.2.0 rb65251d6-b368 Description: The issue allows for XSS via a user profile photo. This can be achieved by including a SCRIPT element in an SVG document...

PT-2020-20270 · Alfresco · Alfresco Community +1

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise versions prior to 5.2.7 Alfresco Community versions prior to 6.2.0 rb65251d6-b368 Description: The issue allows for cross-site scripting XSS attacks via an uploaded document. This can occur when an attacker has write acces...

PT-2020-20268 · Alfresco · Alfresco Community +1

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise versions prior to 5.2.7 Alfresco Community versions prior to 6.2.0 rb65251d6-b368 Description: The issue is related to a Cross-Site Scripting XSS problem. It occurs via the URL property of a file, allowing potential...

CVE-2020-8091

svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname...

CVE-2020-8091

svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname. Recent assessments: Mad-robot at July 05, 2020 1:27pm UTC reported:...

CVE-2020-5217

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

UBUNTU-CVE-2020-5217

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

CVE-2020-5217

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...