Cross site scripting

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

CVE-2020-5905

In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network WCCP page, the system does not sanitize all user-provided data before display...

Code injection

In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network WCCP page, the system does not sanitize all user-provided data before display...

CVE-2020-5903

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

CVE-2020-5903

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

PT-2020-18803

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.1 through 11.6.5.2 Description The issue concerns the BIG-IP system Configuration utility, specifically the Network WCCP page, where user-provided data is not properly sanitized before being displayed. Recommendations F...

CVE-2020-5905: Improper Neutralization of Input During Web Page Generation

In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network WCCP page, the system does not sanitize all user-provided data before display...

CVE-2020-5904: Cross-Site Request Forgery (CSRF)

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery CSRF vulnerability in the Traffic Management User Interface TMUI, also referred to as the Configuration utility, exists in an undisclosed page...

CVE-2020-5903: Improper Neutralization of Input During Web Page Generation

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility...

CVE-2020-5902: Improper Limitation of a Pathname to a Restricted Directory

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote Code Execution RCE vulnerability in undisclosed pages...

CVE-2020-15396

In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root...

Self-Propagating Lucifer Malware Targets Windows Systems

Security experts have identified a self-propagating malware, dubbed Lucifer, that targets Windows systems with cryptojacking and distributed denial-of-service DDoS attacks. The never-before-seen malware initially tries to infect PCs by bombarding them with exploits in hopes of taking advantage of...

CVE-2020-13248: Improper Neutralization of Input During Web Page Generation

BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx...

PT-2020-13394

Name of the Vulnerable Software and Affected Versions BooleBox Secure File Sharing Utility versions prior to 4.2.3.0 Description The issue allows for CSV injection through a crafted user name that is mishandled during export from the activity logs in the Audit Area. Recommendations For versions...

CVE-2020-13247: Improper Neutralization of Formula Elements in a CSV File

BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...

PT-2020-13395

Name of the Vulnerable Software and Affected Versions BooleBox Secure File Sharing Utility versions prior to 4.2.3.0 Description The issue allows for stored XSS via a crafted avatar field within My Account JSON data to the "Account.aspx" endpoint. This can be exploited by manipulating the avatar...

CVE-2020-8102: Improper Input Validation

Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security 2020 versions prior to 24.0.20.116...

CVE-2020-7679

CasperJS is affected by a Prototype Pollution vulnerability in the mergeObjects utility function across all versions. The issue allows an attacker to inject properties into Object.prototype (via proto or similar paths), potentially polluting prototypes and enabling unintended behavior. Documented...

sysstat sysstat.in Buffer Overflow DoS

The vulnerability of the sysstat utility for measuring and analyzing system performance involves the creation of a potentially unsafe script. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service interruptions...

Low: Red Hat Security Advisory: unzip security update

An update for unzip is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...