CVE-2020-25454

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

Cross site scripting

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

CVE-2020-25454

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

CVE-2020-25454

CVE-2020-25454 affects grocy 2.7.1: a Cross-site Scripting (XSS) vulnerability in the add recipe module that executes when deleting a recipe. The issue is described as a stored XSS caused by input in the add recipe flow, with exploitation steps and payload demonstrated in the PacketStorm PoC for ...

Moodle Override Access Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from the fact that some database module web services allow students to add...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2020-63972)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in the Deploy tool Add Proxy in Nagios XI versions prior to 5.7.5. No details of the...

Grocy Household Management Solution 2.7.1 Cross Site Scripting

Exploit Author: Simran Sankhala Vendor Homepage: https://berrnd.de/ Software Link: https://github.com/grocy/grocy Version: 2.7.1 Tested on: Kali Linux 2020.3 CVE ID Alloted : CVE-2020-25454 Proof Of Concept: grocy household management solution v2.7.1, allows stored XSS , via Add recipe module, th...

CVE-2020-27990

Nagios XI before 5.7.5 is vulnerable to a Cross‑Site Scripting (XSS) vulnerability in the Deployment tool (Add Agent/Proxy). The issue affects Nagios XI deployments prior to 5.7.5 and is described across multiple sources (CVE-2020-27990; CNVD-2020-63972). Root cause and exact exploit details are ...

Nagios XI 跨站脚本漏洞

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in the Deploy tool Add Proxy in Nagios XI versions prior to 5.7.5. No details of the...

CVE-2020-26803

In Sentrifugo 3.2, users can upload an image under "Assets - Add" tab. This "Upload Images" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server...

CVE-2020-26803

In Sentrifugo 3.2, users can upload an image under "Assets - Add" tab. This "Upload Images" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server...

Privilege escalation

Uncontrolled search path in IntelR SCS Add-on for Microsoft SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-12320

Uncontrolled search path in IntelR SCS Add-on for Microsoft SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access...

Microsoft Windows Local Spooler Bypass Vulnerability

Windows: Local Spooler CVE-2020-1337 Bypass One way of exploiting this on Windows 10 2004 is to understand that FileNormalizedNameInformation will fail if the new path after the mount point is not under the root directory of the server. For example the admin$ share points to c:\windows. If you se...

CVE-2020-26814

SAP Process Integration PGP Module - Business-to-Business Add On, version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Module of Business-to-Business Add-On, these keys can then be used to read messages processed by the module leading to Information Disclosure...

Information disclosure

SAP Process Integration PGP Module - Business-to-Business Add On, version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Module of Business-to-Business Add-On, these keys can then be used to read messages processed by the module leading to Information Disclosure...

CVE-2020-26814

SAP Process Integration (PGP Module – Business-to-Business Add-On), version 1.0, contains an information-disclosure vulnerability that allows an attacker to read PGP Keys under certain conditions, which can then be used to read messages processed by the module. Root cause and exact exploitation d...

CVE-2020-26814

SAP Process Integration PGP Module - Business-to-Business Add On, version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Module of Business-to-Business Add-On, these keys can then be used to read messages processed by the module leading to Information Disclosure...

kernel: net-sysfs: *_queue_add_kobject refcount issue

A flaw was found in the way the rxqueueaddkobject and netdevqueueaddkobject functions in the Linux kernel handled refcounting of certain objects. This flaw allows a local user who can trigger the error code path to use this vulnerability to disturb the integrity of the system...

idm:DL1 and idm:client security, bug fix, and enhancement update

bind-dyndb-ldap 11.3-1 - New upstream release - Resolves: rhbz1845211 ipa 4.8.7-12.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 4.8.7-12 - Require selinux sub package in the proper version Related: RHBZ1868432 - SELinux: do not double-define nodet and pkitomcatcertt...