17108 matches found
Design/Logic Flaw
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported...
Remote code execution
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...
CVE-2020-15589
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...
Design/Logic Flaw
confdatetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field obtained from the web interface...
Design/Logic Flaw
CodeLathe FileCloud before 20.2.0.11915 allows username enumeration...
Design/Logic Flaw
Froala Editor before 3.2.2 allows XSS via pasted content...
CVE-2020-25200
Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames wil...
Design/Logic Flaw
Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...
Design/Logic Flaw
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy header map API does not replace all existing occurences of a non-inline header...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...
Design/Logic Flaw
Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration...
Fedora: Security Advisory for pandoc (FEDORA-2020-c39d7a562c)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...
[SECURITY] Fedora 33 Update: python-django-3.0.10-3.fc33
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
Design/Logic Flaw
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface SEC-566...
Design/Logic Flaw
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces SEC-564...
Design/Logic Flaw
chsh in cPanel before 88.0.3 allows a Jailshell escape SEC-497...