UBUNTU-CVE-2020-15256

A prototype pollution vulnerability has been found in object-path = 0.11.0 is used, which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is n...

GHSA-CWX2-736X-MF6W Prototype pollution in object-path

Impact A prototype pollution vulnerability has been found in object-path = 0.11.0 is used, which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mo...

Microsoft SharePoint SSI / ViewState Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SharePoint Server-Side Include and ViewState RCE', 'Description' = %q This module exploits a server-side include SSI in SharePoint to...

PT-2020-6065 · Object Path +2 · Object-Path +2

Name of the Vulnerable Software and Affected Versions: object-path versions = 0.11.0...

korealeadercctv.co.kr Cross Site Scripting vulnerability OBB-1390971

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Fedora 31 : 1:libuv (2020-bc0050aa3d)

2020.09.26, Version 1.40.0 Stable Changes since version 1.39.0 : - udp: add UVUDPMMSGFREE recvcb flag Ryan Liptak - include: re-map UVEPROTO from 4046 to -4046 YuMeiJie - doc: correct UVUDPMMSGFREE version added cjihrig - doc: add uvmetricsidletime version metadata Ryan Liptak - win,tty: pass...

Fedora 32 : 1:libuv (2020-77b758d6dc)

2020.09.26, Version 1.40.0 Stable Changes since version 1.39.0 : - udp: add UVUDPMMSGFREE recvcb flag Ryan Liptak - include: re-map UVEPROTO from 4046 to -4046 YuMeiJie - doc: correct UVUDPMMSGFREE version added cjihrig - doc: add uvmetricsidletime version metadata Ryan Liptak - win,tty: pass...

CVE-2020-26518: Improper Neutralization of Special Elements used in an SQL Command

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandoraconsole/include/chartgenerator.php sessionid parameter...

CVE-2020-7735

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option...

Command Injection

Overview ng-packagr is a Compile and package a TypeScript library to Angular Package Format Affected versions of this package are vulnerable to Command Injection via the styleIncludePaths option. Remediation Upgrade ng-packagr to version 10.1.1 or higher. References - GitHub Commit Credit: Snyk...

CVE-2020-24917

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

CVE-2020-24917

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

CVE-2020-24917

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

CVE-2020-24917: Improper Neutralization of Input During Web Page Generation

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...

PT-2020-15856

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.14.3 Description The issue allows for XSS attacks through a crafted filename to the DraftAjaxAPI:: uploadInlineImage function in include/ajax.draft.php. Recommendations For versions prior to 1.14.3, update to versi...

CVE-2020-16193: Improper Neutralization of Input During Web Page Generation

osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...

PT-2020-14795

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.14.3 Description The issue arises from an unvalidated echo call in the include/staff/banrule.inc.php file, specifically echo $info'notes', which allows for XSS attacks. Recommendations For versions prior to 1.14.3,...

PT-2020-14498

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 4.1.29 Description The issue is related to Invalid Parameter Checking, which leads to code injection as root. This is a dynamic class method invocation vulnerability in the include/exportUser.php file. An...

RosarioSIS Cross-Site Scripting Vulnerability

RosarioSIS is a student information system for school management. A cross-site scripting vulnerability exists in RosarioSIS 6.7.2. The vulnerability stems from improper validation of user-supplied input in the PrintSchedules.php script. A remote attacker can exploit the vulnerability by using the...

openSUSE Security Update : nasm (openSUSE-2020-952)

This update for nasm fixes the following issues : nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. - Fix crash due to multiple errors or warnings during the code generation pass if a list file i...