1166 matches found
PT-2020-4977 · Intel · Intel Data Center Manager Console
Name of the Vulnerable Software and Affected Versions: Intel Data Center Manager Console versions prior to 3.6.2 Description: The issue is related to improper permissions in the installer for the Intel Data Center Manager Console, which may allow an authenticated user to potentially enable...
PT-2020-15529 · Jenkins · Jenkins Active Directory Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 1.44 through 2.19 Jenkins Active Directory Plugin versions prior to 2.16.1 and 2.20 Description: The issue allows attackers to log in as any user if a magic constant is used as the password. This is du...
Cross site scripting
Multiple stored cross-site scripting XSS vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations Best-fit Mapping, as demonstrated by the full-width variants of the less-than sign...
freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
libfreerdp/core/update.c in FreeRDP versions 1.1 through 2.0.0-rc4 has an Out-of-bounds Read...
Integer overflow
HUAWEI P30 Pro smartphone with Versions earlier than 10.1.0.160C00E160R2P8 has an integer overflow vulnerability. Some functions are lack of verification when they process some messages sent from other module. Attackers can exploit this vulnerability by send malicious message to cause integer...
Apple macOS Catalina Sandbox Component Command Injection Vulnerability
Apple macOS Catalina is a specialized operating system developed by Apple for Mac computers, of which Sandbox is a sandbox component. A command injection vulnerability exists in the Sandbox component in Apple macOS Catalina versions prior to 10.15.6, which stems from the program failing to proper...
UBUNTU-CVE-2020-12401
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox 80 and Firefox for Android 80...
IBM Cognos Analytics Elevation of Privilege Vulnerability
IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. A security vulnerability exists...
CVE-2020-5611
Cross-site request forgery CSRF vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2020-9259
Huawei Honor V30 smartphones with versions earlier than 10.1.0.212C00E210R5P1 have an improper authentication vulnerability. The system does not sufficiently validate certain parameter passed from the bottom level, the attacker should trick the user into installing a malicious application and...
PT-2020-5249 · Net Snmp +5 · Net-Snmp +5
Name of the Vulnerable Software and Affected Versions: Net-SNMP versions prior to 5.8 Description: The issue is related to improper privilege management in the Net-SNMP software. It allows SNMP WRITE access to the EXTEND MIB, which can be exploited to run arbitrary commands as root. This could...
CVE-2020-12422
In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox 78...
SolarWinds Serv-U FTP Server Input Validation Error Vulnerability
SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A security vulnerability exists in SolarWinds Serv-U FTP Server versions prior to 15.2.1 that stems from the server not validating parameter paths. No details of the vulnerability are provided at this tim...
CVE-2020-12036
Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption e.g., TLS/SSL when configured to send treatment data to a PDMS Patient Data Management System or an EMR Electronic Medical Record system. An attacker could observe...
Foxit Reader and PhantomPDF Resource Management Error Vulnerability (CNVD-2020-32464)
Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit Reader versions prior to 9.2 and PhantomPDF versions prior to 9.2. An attacker could exploit this vulnerability to cause the application to crash...
Joomla! cross-site request forgery vulnerability (CNVD-2020-41803)
Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A security vulnerability exists in Joomla! versions prior to 3.9.19, which stems from a missing token check in compostinstall. The vulnerability can...
SANE Backends Buffer Overflow Vulnerability (CNVD-2020-41085)
SANE Backends is an application programming interface API and communication protocol for regulating communication between software and digital imaging devices. A buffer error vulnerability exists in the 'decodebinary' function in versions of SANE Backends prior to 1.0.30. A remote attacker could...
CVE-2020-12872
yawsconfig.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0...
CVE-2020-12872
yawsconfig.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0...