Design/Logic Flaw

A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipulate a certain binary to load and run a script from a user-writable folder, which then would allow them to execute arbitrary code as roo...

PT-2020-7941

Name of the Vulnerable Software and Affected Versions: fuelux versions prior to 3.15.7 Description: The issue concerns a cross-site scripting vulnerability in the Pillbox feature of the affected software. This vulnerability can be exploited by supplying a script as a value for a new pillbox,...

MGASA-2020-0356 Updated hylafax+ packages fix security vulnerabilities

In HylaFAX+ through 7.0.2, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root CVE-2020-15396. HylaFAX+ through 7.0.2 has scripts that execute binaries from directories writable by unprivileged...

BaserCMS Cross-Site Scripting Vulnerability (CNVD-2020-49572)

BaserCMS is an open source enterprise-level content management system cms. BaserCMS 4.3.6 and earlier versions of contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree. A cross-site scripting vulnerability exists in the js component. An...

CVE-2020-15155

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7...

CVE-2020-15154

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js...

Cross Site Scripting in baserCMS

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js Tested...

GHSA-CPXC-67RC-C775 Cross Site Scripting in baserCMS

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js Tested...

CVE-2020-15155: Improper Neutralization of Input During Web Page Generation

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7...

PT-2020-14231

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.0.0 through 4.3.6 Description The issue is related to Cross Site Scripting XSS via arbitrary script execution, requiring admin access to exploit. The affected components include content fields.php, content info.php, content...

PT-2020-14232

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.3.6 and earlier Description The issue allows for Cross Site Scripting XSS via arbitrary script execution, requiring admin access to exploit. The affected component is the toolbar.php file. Recommendations For versions 4.3.6...

Mitel MiVoice Connect Client Remote Code Execution Vulnerability

Mitel MiVoice Connect is Mitel Networks Canada's software for centralized management of Mitel Networks' call handling and collaboration tools. A remote code execution vulnerability exists in Mitel MiVoice Connect client versions prior to 214.100.1223.0. The vulnerability is related to the affecte...

Microsoft SharePoint Spoofing Vulnerability (CNVD-2020-64002)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A security...

CVE-2020-12456

A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform...

CVE-2020-12456

A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform...

CVE-2020-14350

It was found that some PostgreSQL extensions did not use searchpath safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affect...

Multiple cross-site scripting vulnerabilities in Exment

Overview Exment provided by Kajitori Co.,Ltd contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in some input fields CWE-79 - CVE-2020-5619 Stored cross-site scripting vulnerability in upload files CWE-79 - CVE-2020-5620 Ryoya Koyama of...

JVN#88315581: Multiple cross-site scripting vulnerabilities in Exment

Exment provided by Kajitori Co.,Ltd contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in some input fields CWE-79 - CVE-2020-5619 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4...

PT-2020-3970

Name of the Vulnerable Software and Affected Versions: VMware App Volumes versions 2.x prior to 2.18.6 VMware App Volumes 4 versions prior to 2006 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. A malicious actor with access to create and edit applications or...

Cisco DNA Center Cross-Site Scripting Vulnerability

Cisco DNA Center is the network management and command center for Cisco DNA. A cross-site scripting vulnerability exists in the Web management interface of Cisco DNA Center. The vulnerability stems from the web management interface failing to properly validate user-supplied input. An attacker cou...