PT-2020-20577

Name of the Vulnerable Software and Affected Versions Silverstripe CMS versions prior to 4.6 Description The issue allows for script execution from malicious upload contents under allowed file extensions. For example, HTML code in a TXT file can be executed when stored as protected or draft files...

CVE-2020-9309: Unrestricted Upload of File with Dangerous Type

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions for example HTML code in a TXT file. When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Upload...

CVE-2020-6278

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

PT-2020-19714

Name of the Vulnerable Software and Affected Versions jspdf versions affected versions not specified Description The issue allows an attacker to bypass the filtering regex by using nested script tags or specifically script tags. This can potentially lead to unauthorized execution of scripts...

PT-2020-14171

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.7.0.0 through 1.7.6.5 Description The issue allows for a reflected XSS attack when a corrupted file is sent to the target. This can lead to malicious script execution. The problem is fixed in version 1.7.6.6...

Debian DLA-2269-1 : wordpress security update

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting XSS attacks, create open redirects, escalate privileges, and bypass authorization access. CVE-2020-4046 In affected versions of WordPress, users with lo...

PT-2020-3143 · Cisco · Cisco Unified Communications Manager Session Management Edition +1

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME affected versions not specified Description: The issue is related to insufficient validation of user-supplied...

SecureAuth IdP Client Template Injection Vulnerability

SecureAuth IdP is a suite of identity management solutions from SecureAuth USA. The product supports features such as two-factor authentication and single sign-on. A security vulnerability exists in the SecureAuth.aspx file in SecureAuth IdP version 9.3.0. An attacker can exploit the vulnerabilit...

CVE-2020-9437

SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS...

CVE-2020-9437

SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS...

CVE-2020-9437

SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS...

CVE-2020-9437: Improper Neutralization of Input During Web Page Generation

SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS...

PT-2020-20658

Name of the Vulnerable Software and Affected Versions SecureAuth IdP version 9.3.0 Description The issue is related to a client-side template injection in SecureAuth.aspx, which allows for script execution similar to XSS. This enables potential attackers to execute scripts on the client-side...

DEBIAN-CVE-2020-14939

An issue was discovered in savestructinternal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts that recover a game's state. A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading...

CVE-2020-3350

A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. A...

CVE-2020-3350 Cisco AMP for Endpoints and ClamAV Privilege Escalation Vulnerability

A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. A...

CVE-2020-14210

Concrete details found: MONITORAPP WAF (AIWAF‑VE/AIWAF‑4000) has a reflected XSS vulnerability due to insufficient validation of client data by the web application. Impact is client‑side code execution. No patch/version remediation is specified in the provided documents; exploitation status is no...

PT-2020-13936

Name of the Vulnerable Software and Affected Versions MONITORAPP WAF affected versions not specified Description A Reflected Cross-Site Scripting XSS issue exists where script can be executed when responding to Request URL information. This occurs because the system provides a function to respond...

CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

DEBIAN-CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...