JPaseto weak hash vulnerability

JPaseto is a Java library for creating and parsing Paseto . A weak hash vulnerability exists in JPaseto versions prior to 0.3.0. The vulnerability stems from the fact that JPaseto generates weak hashes when using v2.local tokens. No details of the vulnerability are provided at this time...

Unspecified Vulnerability in Yubico YubiKey Validation Server

Yubico YubiKey Validation Server is an authentication server from the Swedish company Yubico. A security vulnerability exists in the sync endpoint in YubiKey Validation Server versions prior to 2.40. A remote attacker could exploit the vulnerability to conduct replay attacks using previously used...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using empty frames results in excessive resource consumption

A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability...

Denial-of-service vulnerability in NA-VIEW V2.0 (for 15-inch touch screen) of Nanda Aotuo Technology Jiangsu Co.

NA-VIEW is a touch screen configuration software. NA-VIEW V2.0 for 15-inch touch screen has a denial-of-service vulnerability that can be exploited by attackers to construct malformed BMP images that can cause the program to crash...

ppp: Buffer overflow in the eap_request and eap_response functions in eap.c

A buffer overflow flaw was found in the ppp package in versions 2.4.2 through 2.4.8. The bounds check for the rhostname was improperly constructed in the EAP request and response functions which could allow a buffer overflow to occur. Data confidentiality and integrity, as well as system...

VulnCheck KEV: CVE-2020-36854

The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the ajsteps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it...

CVE-2020-8952

Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter...

DEBIAN-CVE-2012-0844

Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar...

CVE-2020-8960

Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS...

Cisco Meeting Server XMPP Denial of Service Vulnerability

Cisco Meeting Server is a video conferencing solution from Cisco that combines place-based video, audio, and Web communications to meet the collaboration needs of the modern workplace. A denial of service vulnerability exists in the Extensible Messaging and Status Protocol XMPP feature in Cisco...

Ansible Information Disclosure Vulnerability (CNVD-2020-22670)

Ansible is a computer system configuration manager from the American company Ansible. The product can be used to publish, manage and orchestrate computer systems.Ansible Engine is one of the Ansible Engines. A security vulnerability exists in Ansible Engine versions 2.7.x, 2.8.x, and 2.9.x. The...

Unspecified Vulnerability in Dot-object

Dot-object is a module to convert json objects using dot representation. A security vulnerability exists in Dot-object versions prior to 2.1.3. An attacker can exploit this vulnerability to add or modify Object.prototype properties with the help of the 'set' parameter...

CVE-2020-9025

Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

Unspecified Vulnerability in OpenVPN Access Server

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for virtual private networks VPNs that use the OpenSSL library to encrypt data and control information.OpenVPN Access Server is a commercial paid version of OpenVPN. A security vulnerability exists in...

PT-2020-15341 · Jenkins · Jenkins Parasoft Environment Manager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Parasoft Environment Manager Plugin versions 2.14 and earlier Description: The issue allows unauthorized access to unencrypted passwords stored in job config.xml files on the Jenkins master. Users with Extended Read permission or acce...

exploit-database-bin-sploits

This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains a collection of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. The aim is to provide a...

UBUNTU-CVE-2017-18641

In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers...

Openfiler Cross-Site Scripting Vulnerability

Openfiler is an open source network storage solution. A cross-site scripting vulnerability exists in admin / system.html in Openfiler version 2.3, which can be exploited by remote attackers to inject arbitrary Web script or HTML with the help of the 'device' parameter...