CVE-2020-9235

Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230C432E9R5P1,Versions earlier than 10.1.0.231C10E3R3P2,Versions earlier than 10.1.0.231C185E3R5P1,Versions earlier than 10.1.0.231C636E3R3P1;Versions earlier than 10.1.0.212C432E10R3P4,Versions earlier than 10.1.0.213C636E3R4P3,Version...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its requestor. Notes: none...

From Layers to Microunits

The evolution of “Code Cohesion” and “Separation of Concerns” The software industry has recognized the values of “Separation of Concerns” and “Code Cohesion” for more than two decades. Many articles, books and software-thinkers have contributed methodologies to implement these important values. I...

PT-2020-20532

Name of the Vulnerable Software and Affected Versions HONOR 20 PRO versions earlier than 10.1.0.230 HONOR 20 PRO versions earlier than 10.1.0.231 HONOR 20 PRO versions earlier than 10.1.0.212 HONOR 20 PRO versions earlier than 10.1.0.160 Description A design error in a module of Huawei smartphone...

Security Bulletin: Multiple vulnerabilities affects IBM Jazz Foundation and IBM Engineering products.

Summary There are multiple vulnerabilities that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS Next, IBM Engineering Lifecycle Optimization - Engineeri...

Design/Logic Flaw

interface/new/newcomprehensivesave.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve remote code execution RCE on the hosting webserver by uploading a maliciously crafted image...

Design/Logic Flaw

All trailer Power Line Communications are affected. PLC bus traffic can be sniffed reliably via an active antenna up to 6 feet away. Further distances are also possible, subject to environmental conditions and receiver improvements...

Design/Logic Flaw

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions...

Design/Logic Flaw

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The networkmanagement service does not properly restrict configuration changes. The LG ID is LVE-SMP-200012 July 2020...

The Blurred Lines and Closed Loops of Google Search

Seemingly small design tweaks to the search results interface may change how and where people find information online...

Design/Logic Flaw

Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit configuration...

Design/Logic Flaw

OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...

Design/Logic Flaw

managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...

CVE-2020-23982

DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'...

CVE-2020-23983

CVE-2020-23983 affects Michael-design iChat Realtime PHP Live Support System 1.6. The vulnerability is a persistent Cross-site Scripting (XSS) flaw triggered via chat and text-field tags, attributed to an input handling issue in the affected component. The provided sources describe the issue but ...

PT-2020-15615

Name of the Vulnerable Software and Affected Versions Michael-design iChat Realtime PHP Live Support System version 1.6 Description The issue is related to persistent Cross-site Scripting. This occurs via chat, specifically through text-field tags. Recommendations For Michael-design iChat Realtim...

CVE-2020-23983: Improper Neutralization of Input During Web Page Generation

Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags...

Design/Logic Flaw

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol SIP ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache...

Design/Logic Flaw

An issue was discovered on Dr Trust ECG Pen 2.00.08 devices. Because the Bluetooth LE support is implemented without a requirement for pairing or security, any attacker can access the GATT server of the device and can sniff the data being broadcasted while a measurement is being done. Also, saved...

CVE-2020-24313

Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "AppointmentID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially...