CVE-2020-27385: Improper Limitation of a Pathname to a Restricted Directory

Incorrect Access Control in the FileEditor /Admin/Views/FileEditor/ in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal, i.e., by entering a .. dot dot path such as...

CVE-2019-19885: Missing Authorization

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0...

CVE-2020-3503: Improper Access Control

A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could...

PT-2020-3127

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software affected versions not specified Description The issue is related to the improper restriction of XML external entity references in the web interface of Cisco SD-WAN vManage Software. This could allow a remote...

PT-2020-11875

Name of the Vulnerable Software and Affected Versions SICAM MMU versions prior to V2.05 SICAM SGU affected versions not specified SICAM T versions prior to V2.18 Description A vulnerability has been identified that could allow an attacker in a privileged network position to conduct a...

CVE-2020-3158: Use of Hard-coded Credentials

A vulnerability in the High Availability HA service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password...

Huawei EulerOS: Security Advisory for netpbm (EulerOS-SA-2019-2426)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2020-1388

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint CE Software affected versions not specified Cisco TelePresence Codec TC Software affected versions not specified Cisco RoomOS Software affected versions not specified Description A vulnerability in the...

EulerOS 2.0 SP2 : netpbm (EulerOS-SA-2019-2426)

According to the versions of the netpbm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The pmmallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service heap-based...

CVE-2019-18675

The Linux kernel through 5.3.13 has a startoffset+size Integer Overflow in cpia2remapbuffer in drivers/media/usb/cpia2/cpia2core.c because cpia2 has its own mmap implementation. This allows local users with /dev/video0 access to obtain read and write permissions on kernel physical pages, which ca...

PT-2019-3851

Name of the Vulnerable Software and Affected Versions SIMATIC IT UADM versions prior to V1.3 Description The issue is related to a predictable encryption key. An authenticated remote attacker could potentially recover a password and gain read and write access to the related TeamCenter station. Th...

Buffer Overflow Vulnerability in Multiple Qualcomm Products (CNVD-2019-18596)

Qualcomm MDM9206 and others are products of Qualcomm Incorporated.The MDM9206 is a central processing unit CPU product.The MDM9607 is a central processing unit CPU product.The SDX20 is a modem.The MDM9206 is a central processing unit CPU product.The MDM9607 is a central processing unit CPU...

mysql: Server: Options unspecified vulnerability (CPU Jul 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Options. Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocol...

PT-2019-2106

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15.1 Update 1 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15.1 Update 1 SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F versions prior to V15....

CVE-2018-14991: Improper Input Validation

The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of...

CVE-2019-3943: Relative Path Traversal

MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files...

Updated firefox packages fix security vulnerability

Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow CVE-2019-9810. Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and...

PT-2019-1567

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software versions prior to 6.225 Cisco NX-OS Software versions prior to 6.222 Cisco NX-OS Software versions prior to 7.03I49 Cisco NX-OS Software versions prior to 7.03I74 Cisco NX-OS Software versions prior to 6.02A810 Cisco NX-OS...

PT-2019-1339

Name of the Vulnerable Software and Affected Versions OpenBMC versions affected versions not specified ASPEED ast2400 and ast2500 Baseband Management Controller BMC hardware and firmware Description The issue is related to access control errors in the OpenBMC software, which can be exploited by a...

CVE-2018-15796: Inadequate Encryption Strength

Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage...