268 matches found
CVE-2020-8281
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting XSS attacks...
Veritas Backup Exec Code Issue Vulnerability
Veritas Technologies Veritas Backup Exec is a powerful suite of data backup and recovery tools from Veritas Technologies. With a web-based management console and an intuitive graphical user interface with easy-to-use wizards, the software simplifies installation and improves manageability...
XSS through image upload on contacts using svg file with png extension (NC-SA-2020-044)
A missing file type check in Nextcloud Contacts 3.4.0 allowed a malicious user to upload SVG files as PNG files to perform XSS attacks...
CVE-2020-8181
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...
PT-2020-20006
Name of the Vulnerable Software and Affected Versions Nextcloud Contacts version 3.2.0 Description A missing file type check allowed a malicious user to upload any file as avatars. Recommendations For Nextcloud Contacts version 3.2.0, update to a version that includes a file type check to prevent...
VulnCheck KEV: CVE-2020-36705
The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...
CVE-2020-15528
An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file permissions and missing file integrity checks...
Design/Logic Flaw
An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file permissions and missing file integrity checks...
CVE-2020-15528
An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file permissions and missing file integrity checks...
CVE-2020-15528: Incorrect Permission Assignment for Critical Resource
An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file permissions and missing file integrity checks...
PT-2020-14479
Name of the Vulnerable Software and Affected Versions GOG Galaxy Client version 2.0.17 Description An issue in the GOG Galaxy Client allows for local escalation of privileges. This occurs when a user starts or uninstalls a game due to weak file permissions and missing file integrity checks...
CVE-2020-13386
In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installation folder. Additionally, when the product is installed, two scheduled tasks are created on the machine, SDMsgUpdate Local and SDMsgUpdate TE. The scheduled...
Ansible Engine Information Disclosure Vulnerability
Ansible is a computer system configuration manager from the American company Ansible. The product can be used to publish, manage and orchestrate computer systems.Ansible Engine is one of the Ansible Engines. A security vulnerability exists in Ansible Engine versions 2.7.x, 2.8.x, and 2.9.x that...
PT-2019-12755
Name of the Vulnerable Software and Affected Versions Akuvox R50P VoIP phone version 50.0.6.156 Description The issue is related to missing file and path validation in the ringtone upload function, allowing an attacker to upload a manipulated ringtone file with an executable payload, such as shel...
fly-admin-local Security Policy Influence
The vulnerability of the fly-admin-local package in the Astra Linux operating system is related to an error in enabling the “kiosk” mode when the /etc/xdg/rusbitech file and the astra-console group are absent. Exploiting this vulnerability can allow a perpetrator to influence certain security...
JVN#55263945: Multiple vulnerabilities in RICOH Interactive Whiteboard
RICOH Interactive Whiteboard provided by RICOH COMPANY, LTD. contains multiple vulnerabilities listed below. Command injection CWE-94 - CVE-2018-16184 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2| AV:N/AC:L/AU:N/C:C/I:C/A:C| Bas...
firefox security update
60.3.0-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one 60.3.0-1 - Update to 60.3.0 ESR 60.2.2-2 - Added patch for rhbz1633932 60.2.2-1 - Update to 60.2.2 ESR 60.2.1-1 - Update to 60.2.1 ESR 60.2.0-1 - Update to 60.2.0 ESR 60.1.0-9 - Do not...
CVE-2018-1593
IBM Multi-Cloud Data Encryption MDE 2.1 could allow an unauthorized user to manipulate data due to missing file checksums. IBM X-Force ID: 143568...