15075 matches found
CVE-2020-28861: Improper Neutralization of Formula Elements in a CSV File
OpenAsset Digital Asset Management DAM 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application...
PT-2020-17044
Name of the Vulnerable Software and Affected Versions OpenAsset Digital Asset Management DAM versions 12.0.19 and earlier Description The issue arises from the software's failure to correctly sanitize user-supplied input in multiple parameters and endpoints, allowing for stored cross-site scripti...
CVE-2020-28857: Improper Neutralization of Input During Web Page Generation
OpenAsset Digital Asset Management DAM through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks...
CVE-2020-28859: Improper Neutralization of Input During Web Page Generation
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks...
PT-2020-17048
Name of the Vulnerable Software and Affected Versions OpenAsset Digital Asset Management DAM versions 12.0.19 and earlier Description The issue is related to a lack of access controls on the "Stream/ProjectsCSV" endpoint, allowing unauthenticated attackers to access potentially sensitive project...
PT-2020-17047
Name of the Vulnerable Software and Affected Versions OpenAssetDigital Asset Management DAM through 12.0.19 Description The issue allows for authenticated blind SQL injection due to the software not correctly sanitizing user-supplied input, which is then incorporated into its SQL queries...
PT-2020-17043
Name of the Vulnerable Software and Affected Versions OpenAsset Digital Asset Management DAM versions 12.0.19 and earlier Description The issue allows attackers to spoof the HTTP request's originating IP address by using the X-Forwarded-For header, potentially bypassing IP address-based access...
PT-2020-17180 · Go +1 · Gosaml2 +2
Name of the Vulnerable Software and Affected Versions: encoding/xml package in Go all versions Description: The issue allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. This can cause XML Digital Signature...
CVE-2020-28856: Authentication Bypass by Spoofing
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access...
CVE-2020-28858: Cross-Site Request Forgery (CSRF)
OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions...
CVE-2020-29654
Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account...
CVE-2020-29654
Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account...
CVE-2020-29563
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...
Design/Logic Flaw
Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account...
Authentication flaw
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...
Fedora: Security Advisory for opensc (FEDORA-2020-7c80831ffe)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2020-29563
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...
CVE-2020-29563
CVE-2020-29563 affects Western Digital My Cloud OS 5 devices prior to 5.07.118. The issue is a NAS Admin authentication bypass that could allow an unauthenticated user to gain access to the device. Public sources in the connected set describe remote authentication bypass affecting the My Cloud PR...
CVE-2020-29654
Western Digital Dashboard prior to version 3.2.2.9 is affected by a DLL hijacking vulnerability that can lead to SYSTEM-level compromise. The issue is due to DLL search order/type handling enabling privilege escalation on a local attacker, with the vulnerability affecting the dashboard executable...