CVE-2020-8235: Authorization Bypass Through User-Controlled Key

Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments...

CVE-2020-5980

NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in multiple components in which a securely loaded system DLL will load its dependencies in an insecure fashion, which may lead to code execution or denial of service...

CVE-2020-5979

NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box for input by a high-privilege process, which may lead to escalation of privileges...

CVE-2020-12127

An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication...

PT-2020-19754 · Unknown · Safetydance

Name of the Vulnerable Software and Affected Versions: safetydance versions all Description: The issue concerns Prototype Pollution via the set function. This affects all versions of the package, allowing for potential manipulation of object properties. Recommendations: For all versions, consider...

ALPINE-CVE-2020-25603

An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier e.g., smp...

DEBIAN-CVE-2020-25604

An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same guest also operating on the timers to release a lock that it...

PYSEC-2020-227

All versions of package cabot are vulnerable to Cross-site Scripting XSS via the Endpoint column...

CVE-2020-7734

All versions of package cabot are vulnerable to Cross-site Scripting XSS via the Endpoint column...

PT-2020-5421

Name of the Vulnerable Software and Affected Versions eDocLib affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the eDocLib platform for storing and processing corporate data. An attacker can exploit this by placing arbitrary co...

all-anatolia.com Cross Site Scripting vulnerability OBB-1310155

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

all-playbacks.co.il Cross Site Scripting vulnerability OBB-1298068

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-5418: Incorrect Authorization

Cloud Foundry CAPI Cloud Controller versions prior to 1.98.0 allow authenticated users having only the "cloudcontroller.read" scope, but no roles in any spaces, to list all droplets in all spaces whereas they should see none...

CVE-2020-7726

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function...

CVE-2020-7713

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor...

PT-2020-20977

Name of the Vulnerable Software and Affected Versions nothing-js affected versions not specified Description The issue concerns a malicious script within the nothing-js module that attempts to delete all files when the command npm test is run. Recommendations Remove the nothing-js module from you...

CVE-2020-23984: Improper Neutralization of Input During Web Page Generation

Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags...

PT-2020-15616

Name of the Vulnerable Software and Affected Versions Online Hotel Booking System Pro PHP version 1.3 Description The issue is related to Persistent Cross-site Scripting in the customer registration form, allowing malicious code to be executed. This affects the all-tags section of the form...

CVE-2020-23974: Improper Neutralization of Input During Web Page Generation

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...