Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2020-36520)

Roundcube Webmail is an open source browser-based IMAP client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in Roundcube Webmail versions prior to 1.3.12 and 1.4.x prior to 1.4.5. The vulnerability stems from a failu...

CVE-2019-6173

A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an attacker already has administrative privileges...

CVE-2020-13892

The SportsPress plugin before 2.7.2 for WordPress allows XSS...

Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2020-35955)

Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site scripting vulnerability exists in Bolt CMS versions prior to 3.7.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

WordPress Elementor Page Builder Cross-Site Scripting Vulnerability (CNVD-2020-35961)

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Elementor Page Builder is a page builder plugin used in it. A cross-site scripting vulnerability exists in WordPress Elementor Page...

Foxit PhantomPDF Resource Management Error Vulnerability (CNVD-2020-32087)

Foxit PhantomPDF is China Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit PhantomPDF versions prior to 8.3.12, where the program creates data for each page at the application level. An attacker could exploit the vulnerability to consume large amounts of memory...

Foxit PhantomPDF Mac and Reader for Mac Buffer Overflow Vulnerability

Foxit PhantomPDF Mac and Foxit Reader for Mac are both China Foxit Foxit company's a macOS-based PDF document reader. A buffer overflow vulnerability exists in Foxit PhantomPDF Mac versions prior to 3.3 and Reader for Mac versions prior to 3.3. The vulnerability originates when a networked system...

Foxit PhantomPDF Code Issue Vulnerability (CNVD-2020-32086)

Foxit PhantomPDF is China's Foxit Foxit company a PDF document reader. A code issue vulnerability exists in Foxit PhantomPDF versions prior to 8.3.12. An attacker could exploit this vulnerability to cause a denial of service...

Foxit PhantomPDF Resource Management Error Vulnerability (CNVD-2020-32088)

Foxit PhantomPDF is China's Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit PhantomPDF versions prior to 8.3.12. An attacker can exploit the vulnerability to exhaust the stack crash...

PT-2020-13708 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList versions prior to 3.5.4 Description: The issue allows for XSS attacks via the "/lists/admin/user.php" and "/lists/admin/users.php" API endpoints. This can potentially lead to malicious script execution. Recommendations: For versions...

MediaWiki Input Validation Error Vulnerability (CNVD-2020-36523)

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. An input validation error vulnerability exists in the...

WordPress mappress-google-maps-for-wordpress code issue vulnerability (CNVD-2020-35726)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. mappress-google-maps-for-wordpress is an interactive maps plugin used in it. A code issue vulnerability exists in WordPress...

snyk-broker path traversal vulnerability

snyk-broker is a proxy program for access between snyk.io and Git repositories. A path traversal vulnerability exists in snyk-broker versions prior to 4.80.0. An attacker can exploit this vulnerability to read arbitrary files on the Snyk internal network...

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Unspecified Vulnerability in Apple Safari (CNVD-2020-52146)

Apple Safari is a web browser from Apple, Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. A security vulnerability exists in Apple Safari versions prior to 13.1.1, which can be exploited by an attacker with the help of a malicious process to cause Safari to...

Unspecified Vulnerability in Apple macOS Catalina Wi-Fi Component

Apple macOS Catalina is a proprietary operating system developed by Apple Inc. for Mac computers.Wi-Fi is one of the wireless Internet components. A security vulnerability in the Wi-Fi component of Apple macOS Catalina prior to version 10.15.5 can be exploited by a local attacker to read kernel...

DEBIAN-CVE-2020-13630

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature...

Horde Gollem Cross-Site Scripting Vulnerability

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. Gollem is a file manager used in it. A cross-site scripting vulnerability exists in Horde Gollem versions prior to 3.0.13 used in Horde Groupware Webmail Edition version 5.2.22 and other products,...

Unspecified Vulnerability in Ivanti Workspace Control (CNVD-2020-33485)

Ivanti Workspace Control RES One Workspace is a set of workspace control software from Ivanti, USA. The software includes features such as user management, application management and report management. A security vulnerability exists in Ivanti WorkSpace Control versions prior to 10.4.40.0, which...

python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...