8585 matches found
UBUNTU-CVE-2020-13430
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...
CVE-2020-13429
legend.ts in the piechart-panel aka Pie Chart Panel plugin before 1.5.0 for Grafana allows XSS via the Values Header aka legend header option...
CVE-2020-13429
legend.ts in the piechart-panel aka Pie Chart Panel plugin before 1.5.0 for Grafana allows XSS via the Values Header aka legend header option...
PT-2020-13535
Name of the Vulnerable Software and Affected Versions Grafana piechart-panel plugin versions prior to 1.5.0 Description The issue allows for XSS via the Values Header option, also known as the legend header. This is a security concern as it can lead to malicious script execution. Recommendations...
CVE-2020-13429: Improper Neutralization of Input During Web Page Generation
legend.ts in the piechart-panel aka Pie Chart Panel plugin before 1.5.0 for Grafana allows XSS via the Values Header aka legend header option...
CVE-2020-1084
A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values.An attacker who successfully exploited this vulnerability could deny dependent security feature functionality.To exploit this vulnerability, an attacker would...
CVE-2020-1084: Improper Input Validation
A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values. An attacker who successfully exploited this vulnerability could deny dependent security feature functionality. To exploit this vulnerability, an attacker would...
CVE-2020-13146
Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...
CVE-2020-12857
Caching of GATT characteristic values TempID in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COVIDSafe...
CVE-2020-12857
CVE-2020-12857 concerns the COVIDSafe Android app, where caching of GATT characteristic values (TempID) in versions 1.0.15 and 1.0.16 allows a remote attacker to long-term re-identify an affected device. The Red Hat, NVD and CVE listings align on the impact: exposure of re-identification risk due...
CVE-2020-12858: Use of Insufficiently Random Values
Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons...
Spring Security Security Feature Issue Vulnerability
Spring Security, formerly known as Acegi Security , is a framework used by the Spring project team to provide secure authentication services. A security signature issue vulnerability exists in Spring Security. An attacker can exploit this vulnerability to obtain unencrypted values with the help o...
Open redirect
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting ...
CVE-2020-10612
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting ...
TYPO3 Direct Mail Component Information Disclosure Vulnerability (CNVD-2020-28942)
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and prior versions, which originates from the program's inability to check whether an authenticated back-end user...
CVE-2020-9502: Use of Insufficiently Random Values
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device...
jewishvaluesonline.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1159510 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
PT-2020-2729
Name of the Vulnerable Software and Affected Versions curlrequest versions 1.0.0 through 1.0.1 Description The issue allows for the execution of arbitrary commands by injecting commands using a semicolon character in any of the options values. This can enable a remote attacker to execute arbitrar...
DRUPAL-CONTRIB-2020-013
The Webform module allows site builders to create forms. The module doesn't sufficiently prevent malicious code from being render via an options elements i.e select menu, checkboxes, radios, etc... under the scenario where the site builder allows the raw option value to be displayed. This...
Security Bulletin: Multiple vulnerabilities in Node.js affects IBM App Connect Enterprise V11
Summary IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2019-15606 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused ...