PT-2020-16308 · Live Helper Chat · Livehelperchat

Name of the Vulnerable Software and Affected Versions: Live Helper Chat versions prior to 3.44v Description: The issue allows for stored XSS in chat messages with an operator via BBCode. This means that an attacker can inject malicious code into chat messages, which can then be executed by the...

PT-2020-4171 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: The issue is related to multiple vulnerabilities in the web management framework of Cisco IOS XE Software. These vulnerabilities could allow an authenticated, remote attacker...

Drupal 8.x, 9.x Multiple Vulnerabilities (SA-CORE-2020-008, SA-CORE-2020-009, SA-CORE-2020-010, SA-CORE-2020-011) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

PT-2020-20925 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.0 iPadOS versions prior to 14.0 tvOS versions prior to 14.0 watchOS versions prior to 7.0 Xcode versions prior to 12.0 Description: The issue allows an attacker in a privileged network position to execute arbitrary co...

PT-2020-15506 · Jenkins · Jenkins Storable Configs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Storable Configs Plugin version 1.0 and earlier Description: The issue allows users with Job/Read permission to read arbitrary files on the Jenkins controller. Recommendations: For Jenkins Storable Configs Plugin version 1.0 and...

PT-2020-15483 · Cloudbees +1 · Jenkins Health Advisor By Cloudbees Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Health Advisor by CloudBees Plugin versions 3.2.0 and earlier Description: The issue arises from an incorrect permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view the endpoint, which includes a...

UBUNTU-CVE-2020-8927

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli...

PT-2020-10876 · Twitter · Bootstrap-Select

Name of the Vulnerable Software and Affected Versions: bootstrap-select versions prior to 1.13.6 Description: The issue allows Cross-Site Scripting XSS due to the failure to escape title values in OPTION elements. This may enable attackers to execute arbitrary JavaScript in a victim's browser...

GHSA-F5CV-XRV9-R8W7 NoSQL injection in express-cart

Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which...

GHSA-53MJ-MC38-Q894 Remote Memory Exposure in openwhisk

Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure. When a number is passed to apikey, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header base64-encoded. Proof of concept: js var openwhisk = require'openwhisk...

PT-2020-7931

Name of the Vulnerable Software and Affected Versions: jws versions prior to 3.0.0 Description: The issue allows a malicious actor to modify the contents of a JWT while still passing verification, potentially leading to a complete authentication bypass. This can be achieved by exploiting the...

PT-2020-19737 · Npm · Deep-Get-Set

Name of the Vulnerable Software and Affected Versions: deep-get-set versions prior to 1.1.1 Description: The issue concerns Prototype Pollution via the main function. Recommendations: For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue...

WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...

ISC BIND DoS Vulnerability (CVE-2020-8620) - Linux

ISC BIND is prone to a denial of service vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

PrestaShop 1.5.3.0 < 1.7.6.6 XSS Vulnerability

PrestaShop is prone to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

PrestaShop 1.5.5.0 < 1.7.6.5 Multiple Vulnerabilities

PrestaShop is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PrestaShop 1.7.6.0 < 1.7.6.5 Multiple Vulnerabilities

PrestaShop is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PHP < 4.4.8 Multiple Vulnerabilities

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...

PHP < 5.2.7 Multiple Vulnerabilities

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...

Apache Struts 2.x < 2.5.22 Multiple Vulnerabilities (S2-059, S2-060) - Linux

Apache Struts is prone to multiple vulnerabilities. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...