PT-2020-16277

Name of the Vulnerable Software and Affected Versions Nifty-PM CPE version 2.3 Description The issue concerns stored HTML injection, which can lead to remote arbitrary code execution. Recommendations For Nifty-PM CPE version 2.3, update to a version that fixes the stored HTML injection issue to...

CVE-2020-14189

The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment...

PT-2020-5381

Name of the Vulnerable Software and Affected Versions Moxa Inc EDR-G903 Series versions 5.5 or lower Moxa Inc EDR-G902 Series versions 5.5 or lower Moxa Inc EDR-810 Series versions 5.6 or lower Description The issue is related to an improper restriction of operations, which may allow remote...

Cisco Data Center Network Manager REST API Arbitrary Action

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to the use of an incomplete blacklist. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

Design/Logic Flaw

The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a custom request using the rename function provided by the file manager is able to modify the image extension into PHP resulting in remote...

CVE-2020-25453: Cross-Site Request Forgery (CSRF)

An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability bypass csrftoken that allows remote arbitrary code execution...

PT-2020-16082

Name of the Vulnerable Software and Affected Versions BlackCat CMS versions prior to 1.4 Description An issue in BlackCat CMS allows for a CSRF vulnerability, which can be exploited to bypass the csrf token and enable remote arbitrary code execution. Recommendations For versions prior to 1.4,...

PT-2020-15585

Name of the Vulnerable Software and Affected Versions ArGo Soft Mail Server version 1.8.8.9 Description The issue allows for Cross Site Request Forgery CSRF that can lead to remote arbitrary code execution. This is specifically related to the Administration dashboard component. When an...

NPort IAW5000A-I/O Series Web Server Access Control

The vulnerability of the NPort IAW5000A-I/O Series web server software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to send arbitrary requests to the vulnerable system remotely...

PT-2020-5335

Name of the Vulnerable Software and Affected Versions Adobe Premiere Pro versions 14.2 and earlier Description The issue is related to an out-of-bounds write vulnerability in Adobe Premiere Pro. Successful exploitation could lead to arbitrary code execution. This vulnerability is associated with...

SiNVR 3 Central Control Server XML Protocol Arbitrary Action

The vulnerability of the central control server of SiNVR 3 Central Control Server is related to security vulnerabilities in the XML-based communication protocol. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

Remote Code Execution (RCE)

ncurses is vulnerable to denial of service. Due to a flaw, there is a format string vulnerability in the fmtentry function. A crafted input will lead to a remote arbitrary code execution attack...

PT-2020-2465

Name of the Vulnerable Software and Affected Versions Adobe Illustrator versions 24.0.2 and earlier Description The issue is related to a memory corruption vulnerability in Adobe Illustrator. Successful exploitation could lead to arbitrary code execution. The vulnerability is also described as a...

CVE-2019-11999

Potential security vulnerabilities have been identified in HPE OpenCall Media Platform OCMP resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. For OCMP version 4.4.X -...

Cross site scripting

Potential security vulnerabilities have been identified in HPE OpenCall Media Platform OCMP resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. For OCMP version 4.4.X -...

CVE-2019-11999

Potential security vulnerabilities have been identified in HPE OpenCall Media Platform OCMP resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. For OCMP version 4.4.X -...

CVE-2019-11999

CVE-2019-11999 concerns HPE OpenCall Media Platform (OCMP). Public docs describe a vulnerability in OCMP versions 4.4.x prior to 4.4.8 and 4.5.x prior to an updated release, enabling remote arbitrary file download and cross-site scripting due to insufficient input validation. The described fixes ...

WebKit Memory Use After Free

The vulnerability of the WebKit rendering module in operating systems such as Mac OS X, iOS, tvOS, Safari browser, multimedia player iTunes, and iCloud service is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code memor...

Engine.IO WebSocket Cross-site Request Manipulation

The vulnerability of the WebSocket protocol in the Engine.IO web server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable system remotely...

Cisco Webex Video Mesh Command Execution

The vulnerability of the Cisco Webex Video Mesh software control web interface is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...