9938 matches found
Code injection
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...
CVE-2020-8116
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...
CVE-2020-8116
CVE-2020-8116: Prototype pollution in the dot-prop npm package. Affected versions are dot-prop before 4.2.1 and 5.x before 5.1.1, which can allow an attacker to add arbitrary properties to JavaScript language constructs. The vulnerability is listed among multiple issues in MiracleLinux AXSA advis...
CVE-2020-8116
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...
CVE-2020-8116
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...
Node.js third-party modules: [nested-property] Prototype Pollution
Hi team, I would like to report a prototype pollution vulnerability in nested-property that allows an attacker to modify properties on Object.prototype. Module name:nested-property version: 1.0.4 npm page: https://www.npmjs.com/package/nested-property Module Description Read, write or test a data...
CVE-2020-7939
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
CVE-2020-7939
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
PYSEC-2020-88
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
PYSEC-2020-88
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
CVE-2020-7939
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
Huawei EulerOS: Security Advisory for sssd (EulerOS-SA-2019-2667)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for sssd (EulerOS-SA-2019-2190)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2020-19861
Name of the Vulnerable Software and Affected Versions Plone versions 4.0 through 5.2.1 Description The issue allows users to perform unwanted SQL queries due to SQL Injection in DTML or in connection objects. This problem is related to Zope. Recommendations For Plone versions 4.0 through 5.2.1,...
CVE-2020-7939: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
SAP BusinessObjects Business Intelligence Web Intelligence Unauthorized Access
The vulnerability of the Web Intelligence component of the SAP BusinessObjects Business Intelligence platform is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
PT-2020-13000
Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Services Platform affected versions not specified Description The issue concerns the redundancy host service RdcyHost.exe not validating supplied identifiers. This could allow an unauthenticated, adjacent attack...
HackerOne: Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects
The Checklist objects that can be queried through GraphQL are supposed to only be accessible by program members, the users who claimed or responded to a check belonging to a checklist, and HackerOne Pentesters. The Checklist object is also supposed to be in the running state e.g. when the platfor...
VulnCheck KEV: CVE-2020-0650
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0651, CVE-2020-0653...
Microsoft Windows Search Indexer elevation of privilege vulnerability (CNVD-2020-16655)
Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in the way memory objects are handled in Microsoft Windows Search Indexer. An attacker could exploit the vulnerability to execute code with elevated...