PT-2020-19601

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0 SugarCRM versions 8.0 through 8.0.6 SugarCRM versions 9.0 through 9.0.3 SugarCRM versions 10.0 through 10.0.0 Description The issue concerns an authorization bypass and PHP local-file-include vulnerability in the...

SIGE (Joomla) 3.4.1 & 3.5.3 Pro - Multiple Vulnerabilities

Document Title: =============== SIGE Joomla 3.4.1 & 3.5.3 Pro - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2265 Release Date: ============= 2020-11-11 Vulnerability Laboratory ID VL-ID: ====================================...

DEBIAN-CVE-2020-15256

A prototype pollution vulnerability has been found in object-path = 0.11.0 is used, which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is n...

UBUNTU-CVE-2020-15256

A prototype pollution vulnerability has been found in object-path = 0.11.0 is used, which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is n...

GHSA-CWX2-736X-MF6W Prototype pollution in object-path

Impact A prototype pollution vulnerability has been found in object-path = 0.11.0 is used, which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mo...

PT-2020-6065 · Object Path +2 · Object-Path +2

Name of the Vulnerable Software and Affected Versions: object-path versions = 0.11.0...

Microsoft SharePoint SSI / ViewState Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SharePoint Server-Side Include and ViewState RCE', 'Description' = %q This module exploits a server-side include SSI in SharePoint to...

korealeadercctv.co.kr Cross Site Scripting vulnerability OBB-1390971

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Fedora 31 : 1:libuv (2020-bc0050aa3d)

2020.09.26, Version 1.40.0 Stable Changes since version 1.39.0 : - udp: add UVUDPMMSGFREE recvcb flag Ryan Liptak - include: re-map UVEPROTO from 4046 to -4046 YuMeiJie - doc: correct UVUDPMMSGFREE version added cjihrig - doc: add uvmetricsidletime version metadata Ryan Liptak - win,tty: pass...

Fedora 32 : 1:libuv (2020-77b758d6dc)

2020.09.26, Version 1.40.0 Stable Changes since version 1.39.0 : - udp: add UVUDPMMSGFREE recvcb flag Ryan Liptak - include: re-map UVEPROTO from 4046 to -4046 YuMeiJie - doc: correct UVUDPMMSGFREE version added cjihrig - doc: add uvmetricsidletime version metadata Ryan Liptak - win,tty: pass...

CVE-2020-26518: Improper Neutralization of Special Elements used in an SQL Command

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandoraconsole/include/chartgenerator.php sessionid parameter...

CVE-2020-7735

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option...

Command Injection

Overview ng-packagr is a Compile and package a TypeScript library to Angular Package Format Affected versions of this package are vulnerable to Command Injection via the styleIncludePaths option. Remediation Upgrade ng-packagr to version 10.1.1 or higher. References - GitHub Commit Credit: Snyk...

CVE-2020-24917

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

CVE-2020-24917

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

CVE-2020-24917

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

CVE-2020-24917: Improper Neutralization of Input During Web Page Generation

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

PT-2020-15856

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.14.3 Description The issue allows for XSS attacks through a crafted filename to the DraftAjaxAPI:: uploadInlineImage function in include/ajax.draft.php. Recommendations For versions prior to 1.14.3, update to versi...

PT-2020-14795

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.14.3 Description The issue arises from an unvalidated echo call in the include/staff/banrule.inc.php file, specifically echo $info'notes', which allows for XSS attacks. Recommendations For versions prior to 1.14.3,...

CVE-2020-16193: Improper Neutralization of Input During Web Page Generation

osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...