7827 matches found
CVE-2020-13451
CVE-2020-13451 affects Gotenberg up to version 6.2.1. The issue is described as an incomplete-cleanup vulnerability in the Office rendering engine, enabling an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros. Connected documents corroborate the vulnerab...
CVE-2020-13451: Incomplete Cleanup
An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros...
PT-2021-9613
Name of the Vulnerable Software and Affected Versions Gotenberg versions through 6.2.1 Description An incomplete-cleanup vulnerability in the Office rendering engine allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros. Recommendations For Gotenber...
CVE-2020-17008 splWOW64 Elevation of Privilege Patch Bypass
This CVE is the result of a patch bypass for CVE-2020-0986, reported to Microsoft by Kaspersky in December 2019 and patched in June 2020. Google Project Zero researcher Maddie Stone notified Microsoft on September 24, 2020 that the fix for Kaspersky’s reported vulnerability was incomplete...
Arbitrary File Read
AWStats is vulnerable to arbitrary file read. cgi-bin/awstats.pl?config= accepts a partial absolute pathname omitting the initial /etc, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-100050...
Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
...
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
Missing Authentication Due To Incorrect Configuration
Apache Tomee openejb-core has missing authentication. The vulnerability exists due to an incomplete fix of CVE-2020-11969 where when embedded ActiveMQ broker with URI setting useJMX=true is used, it causes JMX port to open on TCP port 1099, which does not include authentication...
RHEL 8 : CloudForms 5.0.10 (RHSA-2020:5554)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5554 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments...
RHEL 7 : java-1.7.1-ibm (RHSA-2020:5586)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5586 advisory. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IB...
RHEL 7 : java-1.8.0-ibm (RHSA-2020:5585)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5585 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...
GHSA-M7J4-FHG6-XF5V datatables.net vulnerable to Prototype Pollution due to incomplete fix
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806...
datatables.net vulnerable to Prototype Pollution due to incomplete fix
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806...
CVE-2020-35545
Time-based SQL injection exists in Spotweb 1.4.9 via the query string...
CVE-2020-28458
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806...
AZL-53184 CVE-2020-28458 affecting package reaper for versions less than 3.1.1-15
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806...
