PT-2021-1645 · Cisco · Cisco Connected Mobile Experiences

Name of the Vulnerable Software and Affected Versions: Cisco Connected Mobile Experiences CMX affected versions not specified Description: The issue is related to a lack of authorization checks for certain API GET requests, which could allow an authenticated, remote attacker to enumerate users on...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none...

CVE-2020-6713

CVE-2020-6713 entry is rejected/not used and does not represent an active vulnerability entry.

PT-2021-9003

Name of the Vulnerable Software and Affected Versions Rock RMS versions prior to 8.6 Description The issue allows for account takeover by tampering with the user ID parameter in the profile update feature. This is possible due to the lack of validation and the use of sequential user IDs, enabling...

CVE-2020-36173

The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields...

PT-2021-11953

Name of the Vulnerable Software and Affected Versions: Ninja Forms plugin versions prior to 3.4.28 Description: The issue is related to a lack of escaping for submissions-table fields in the Ninja Forms plugin for WordPress. This could potentially lead to security issues, although specific detail...

PT-2021-18592

Name of the Vulnerable Software and Affected Versions Seal Finance Seal affected versions not specified Description The issue concerns a lack of access control in the breed function of the smart contract implementation for Farm in Seal Finance, allowing price manipulation. This has been exploited...

PT-2020-12883

Name of the Vulnerable Software and Affected Versions Oppo charger affected versions not specified Description The issue is caused by a failure to check the parameter buf in the function proc work mode write in the file oppo da9313.c. This lack of validation leads to a vulnerability. No informati...

Prototype Pollution

deep-set is vulnerable to prototype pollution. The vulnerability exists through the lack of sanitization of proto header values...

CVE-2020-9208

There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authentication. Attackers without access to the module can exploit this vulnerability to obtain extra information, leading to information leak...

PT-2020-20524

Name of the Vulnerable Software and Affected Versions iManager NetEco 6000 version V600R021C00 Description The issue is related to an information leak due to a lack of authentication in a module. Attackers without access to the module can exploit this to obtain extra information. Recommendations...

CVE-2020-35784: Undefined Security Weakness

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and GS116Ev2 before 2.6.0.48...

Server-Side Template Injection

browserup-proxy is vulnerable to server-side template injection. The vulnerability exists through the lack of sanitization of value when displaying error messages...

Open Redirect

autobahn is vulnerable to open redirect. The vulnerability exists through the lack of encoding on the value of the redirect header...

CVE-2020-35677

BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the...

PT-2020-17387

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System versions prior to 4.0 Description The issue arises from inadequate sanitization of fields for HTML characters when an administrator creates a new group using the "admin/pageEditGroup.php" endpoint, resulting in...

2020 Shows the Danger of a Decapitated Cyber Regime

Trump's White House has long been AWOL on cybersecurity. That lack of oversight almost seemed to be working—until the SolarWinds hack...

CVE-2020-35587: Missing Encryption of Sensitive Data

In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files contain non-obfuscated code. NOTE: it is unclear whether lack of obfuscation is directly associated with a negative impact, or instead only facilitates an attack technique...

CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

(0Day) Eaton EASYsoft E70 File Parsing Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Eaton EASYsoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of E70...