PT-2020-16951 · Maxmind +8 · Libmaxminddb +8

Name of the Vulnerable Software and Affected Versions: libmaxminddb versions prior to 1.4.3 Description: The issue is a heap-based buffer over-read in the dump entry data list function in maxminddb.c. This occurs in libmaxminddb before version 1.4.3. Recommendations: For versions prior to 1.4.3,...

PT-2020-6955 · Citrix +1 · Citrix Ica +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R8 Description: A cross-site scripting XSS issue exists due to insufficient cleaning of user-provided data transmitted through the URL used for Citrix ICA. This allows a remote attacker to conduct an...

PT-2020-4942 · Trustwave +2 · Opendmarc +2

Name of the Vulnerable Software and Affected Versions: OpenDMARC versions 1.3.2 and 1.4.x through 1.4.0-Beta1 Description: The issue is related to improper null termination in the opendmarc xml parse function, which can result in a one-byte heap overflow in opendmarc xml when parsing a specially...

PT-2020-18974 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe versions through 4.5.0 Description: A specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a SilverStripe application, without revealing the...

PT-2020-3216 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to a cross-site scripting XSS attack, which occurs when the software does not...

PT-2020-3296 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to insufficient sanitization of web requests, which can lead to cross-site...

CVE-2020-8916

A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver eg: debug environments can allow an attacker to crash the service DoS. We recommend updating, or to...

PT-2020-15417 · Jenkins · Jenkins Fortify On Demand Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Plugin versions 5.0.1 and earlier Description: A cross-site request forgery issue allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This issue...

PT-2020-6383 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 12.1.0 through 12.1.5.1 F5 BIG-IP versions 13.1.0 through 13.1.3.3 F5 BIG-IP versions 14.1.0 through 14.1.2.5 F5 BIG-IP versions 15.0.0 through 15.1.0.3 Description: The issue is related to a lack of protection for the web...

PT-2020-6758 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to insufficient protection of credentials in the Zyxel CloudCNM SecuManager software, which can allow a remote attacker to gain full access to devices o...

PT-2020-14377 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get user id and key" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access...

PT-2020-14364 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak permissions in the /opt/axess/var/blobstorage/ directory. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access to the...

PT-2020-14538 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax ftp...

PT-2020-14549 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax dashboard.php file,...

PT-2020-14070 · Squirrelmail · Squirrelmail

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.4.22 Description: The issue arises in compose.php, where the $attachments value from an HTTP POST request is passed to unserialize. This could potentially lead to PHP object injection. However, the vendor disputes this,...

PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...

PT-2020-14012 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows directory traversal via HTTP. This issue affects Mattermost Server and is related to the mmctl component. Recommendations: For versions prior to 5.21....

PT-2020-13893 · Ngircd · Ngircd

Name of the Vulnerable Software and Affected Versions: ngIRCd versions prior to 26rc2 Description: The Server-Server protocol implementation in ngIRCd allows an out-of-bounds access, as demonstrated by the IRC NJOIN function. Recommendations: For versions prior to 26rc2, update to version 26rc2 o...

PT-2020-13229 · Redash · Redash

Name of the Vulnerable Software and Affected Versions: Redash open-source versions 8.0.0 and prior Description: An authenticated Server-Side Request Forgery SSRF was discovered via the JSON data source. This issue provides flexibility in crafting HTTP requests, such as adding headers and selectin...

PT-2020-8637 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana version 5.3.1 Description: The issue is related to an incomplete fix, resulting in a XSS vulnerability via the "Dashboard Text Panel" screen. This allows for potential exploitation. Recommendations: For Grafana version 5.3.1, consider...