Mozilla Network Security Services Information Disclosure Vulnerability (CNVD-2020-39017)

Mozilla Network Security Services NSS is a library of functions Network Security Services library from the Mozilla Foundation in the United States. The product provides cross-platform support for SSL, S/MIME and other Internet security standards. A security vulnerability exists in Mozilla NSS...

Arbitrary Code Injection

Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Arbitrary Code Injection. An object like "foo": /1"/, "bar": "a"@R--0@" would be serialized as "foo": /1"/,...

CVE-2020-12257

rConfig 3.9.4 is vulnerable to cross-site request forgery CSRF because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form add a user, delete a user, or edit a user...

DRUPAL-CONTRIB-2020-019

The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are...

Solis Gnuteca SQL Injection Vulnerability

Solis Gnuteca is a library management system from Solis Brazil. The system includes features such as e-mail alerts, automated inventory, location tracking and user registration. A SQL injection vulnerability exists in Solis Gnuteca version 3.8. The vulnerability stems from a database-based...

WordPress Chop Slider SQL Injection Vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Chop Slider is a jQuery slider plugin used in it. A SQL injection vulnerability exists in the 'id' GET parameter of the...

CVE-2020-12764

Gnuteca 3.8 allows file.php?folder=/&file= Directory Traversal...

McAfee Endpoint Detection and Response Privileging Vulnerability (CNVD-2020-35071)

McAfee Endpoint Detection and Response EDR is a suite of endpoint threat detection and response solutions from the U.S.-based company McAfee McAfee. The product supports threat event monitoring, host traffic monitoring and automatic threat identification and other functions. A power lifting...

CVE-2019-18871

A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution...

Ntop nDPI Input Validation Error Vulnerability

Ntop nDPI is an open source library for deep packet inspection from Ntop Italy. An input validation error vulnerability exists in the SSH protocol parser in Ntop nDPI 3.2 Stable and prior versions, which can be exploited by attackers to execute code or perform network traffic analysis...

ABB Telephone Gateway TG/S and Busch-Jaeger 6186/11 Telefon-Gateway Information Disclosure Vulnerability

The ABB Telephone Gateway TG/S and the Busch-Jaeger 6186/11 Telefon-Gateway are both a telephone gateway product from ABB Switzerland. A security vulnerability exists in ABB Telephone Gateway TG/S version 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. The vulnerability stems from a lack of effecti...

CVE-2020-11826

Users can lock their notes with a password in Memono version 3.8. Thus, users needs to know a password to read notes. However, these notes are stored in a database without encryption and an attacker can read the password-protected notes without having the password. Notes are stored in the ZENTITY...

CVE-2020-6230

SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2020-6974

Honeywell Notifier Web Server NWS Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem...

net-snmp: double free in usm_free_usmStateReference function in snmplib/snmpusm.c via an SNMPv3 GetBulk request

net-snmp before 5.8.1.pre1 has a double free in usmfreeusmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release...

Denial of Service Vulnerability in Codesys v3

Codesys is a powerful PLC software programming tool. A denial of service vulnerability exists in Codesys v3, which can be exploited by an attacker to cause a denial of service...

File Upload Vulnerability in opencart 3.6

OpenCart is an open source e-commerce system. A file upload vulnerability exists in opencart 3.6, which can be exploited by an attacker to execute commands and gain server administrator privileges...

3S-Smart Software Solutions CODESYS V3 web server buffer overflow vulnerability (CNVD-2020-20436)

3S-Smart Software Solutions CODESYS V3 web server is a web server used in CODESYS products from 3S-Smart Software Solutions, Germany. A buffer overflow vulnerability exists in 3S-Smart Software Solutions CODESYS V3 web server versions prior to 3.5.15.40 used in the CODESYS Control runtime system...

IBM Content Navigator Information Disclosure Vulnerability (CNVD-2020-19221)

IBM Content Navigator is a Web client from IBM USA. The product supports searching and processing documents stored in content servers from a Web browser. A security vulnerability exists in IBM Content Navigator version 3.0CD. An attacker can exploit the vulnerability to obtain sensitive informati...

Mozilla Bleach Cross-Site Scripting Vulnerability

Mozilla Bleach is an HTML cleanup library from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in bleach.clean in Mozilla Bleach versions prior to 3.12. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...