18093 matches found
Design/Logic Flaw
REDDOXX MailDepot 2033 aka 2.3.3022 allows XSS via an incoming HTML e-mail message...
Design/Logic Flaw
An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to the web tree...
Design/Logic Flaw
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...
Design/Logic Flaw
Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream...
Design/Logic Flaw
Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming username and password via SQLite files containing plain text credentials...
Design/Logic Flaw
In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants...
Design/Logic Flaw
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program...
Design/Logic Flaw
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls ksesremovefilters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles...
Design/Logic Flaw
This affects the package doc-path before 2.1.2...
Design/Logic Flaw
Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::ReceivedData, leading to an exception thrown from libprotobuf and resulting in a crash...
Design/Logic Flaw
Improper isolation of shared resources in some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
Design/Logic Flaw
Out-of-bounds read in subsystem for IntelR AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-27708. Reason: This candidate is a reservation duplicate of ID. Notes: All CVE users should reference CVE-2020-27708 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
Design/Logic Flaw
Adobe Acrobat Reader for Android version 20.6.2 and earlier does not properly restrict access to directories created by the application. This could result in disclosure of sensitive information stored in databases used by the application. Exploitation requires a victim to download and run a...
Design/Logic Flaw
Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by modifying a file that is later executed by a higher-privileged user...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-28050. Reason: This candidate is a reservation duplicate of CVE-2020-28050. Notes: All CVE users should reference CVE-2020-28050 instead of this candidate. All references and descriptions in this candidate have been removed t...
Design/Logic Flaw
Microweber v1.1.18 is affected by no session expiry after log-out...
Design/Logic Flaw
ati2dblt in hw/display/ati2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process...
SQL Injection Vulnerability in Taiwan Billionaire Web Design Company's Website Building System
Taiwan Billion Web Design is a web design company. A SQL injection vulnerability exists in the web design system of Taiwan Billion Web Design Company, which can be exploited by attackers to obtain sensitive information from the database...