12832 matches found
EmbedThis GoAhead Web Server 5.1.1 Digest Authentication Capture Replay Nonce Reuse
Summary GoAhead is the world's most popular, tiny embedded web server. It is compact, secure and simple to use. GoAhead is deployed in hundreds of millions of devices and is ideal for the smallest of embedded devices. Description A security vulnerability affecting GoAhead versions 2 to 5 has been...
CVE-2020-26160
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with string for m"aud" which is allowed by the specification. Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lac...
CVE-2020-19672
Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter upload, bypass the getimagesize function, upload php file, getshell...
CVE-2020-19672
Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter upload, bypass the getimagesize function, upload php file, getshell...
CVE-2020-26160
The CVE-2020-26160 entry concerns jwt-go prior to 4.0.0-preview1. The vulnerability allows bypass of audience restrictions when m["aud"] is []string{}; due to a type assertion failure, aud becomes the empty string, which is problematic if a service does not enforce its own audience checks. The pr...
Moderate: Red Hat Security Advisory: libxslt security update
An update for libxslt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...
httpd: <FilesMatch> bypass with a trailing newline in the file name
In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the...
KLA11967 Multiple vulnerabilites in Opera
Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, gain privileges, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1...
KLA11968 Multiple vulnerabilities in Foxit Reader
Multiple vulnerabilities were found in Foxit Reader. Malicious users can exploit these vulnerabilities to . Below is a complete list of vulnerabilities: 1. Out of bounds read vulnerability can be exploited remotely to execute arbitrary code and cause denial of service. 2. Elevation of privilege...
CVE-2020-26099
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism SEC-491...
CVE-2020-15840
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs...
CVE-2020-15840
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs...
Design/Logic Flaw
A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a...
CVE-2020-15840
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs...
CVE-2020-26088
A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a...
CVE-2020-26088
CVE-2020-26088 affects the Linux kernel up to version 5.8.2, where a missing CAP_NET_RAW check in NFC socket creation (net/nfc/rawsock.c) could let a local attacker create raw sockets and bypass security mechanisms. This is demonstrated in multiple Nessus advisories (Unity Linux/OpenSUSE/EulerOS ...
IBM Data Risk Manager Security Mechanism Bypass Vulnerability
IBM Data Risk Manager is a data risk manager that helps discover, analyze and visualize business risks associated with data. A security mechanism bypass vulnerability exists in IBM Data Risk Manager 2.0.6. An attacker could exploit the vulnerability to perform administrator actions beyond their...