Extreme View has a heap overflow vulnerability

Extreme Viewer is the current ultra-fast and ultra-high-definition viewing software, compatible with all mainstream image formats and professional image formats. Extreme Viewer suffers from a heap overflow vulnerability that can be exploited by attackers to cause a denial of service attack...

Extreme View has a UAF vulnerability

Extreme Viewer is the current ultra-fast and ultra-high-definition viewing software, compatible with all mainstream image formats and professional image formats. A heap overflow vulnerability exists, which can be exploited by an attacker to cause the software to crash...

CVE-2020-13241

CVE-2020-13241 affects Microweber 1.1.18. The issue is an uncontrolled/unrestricted file upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the added file’s extension corresponds to an image file. This can enable upload of non-image files via the Add Image option...

CVE-2020-13241

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...

UBUNTU-CVE-2020-13230

In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account e.g., permission to view logs...

Horde Groupware Webmail < 5.2.22 XSS Vulnerability - Linux

Horde Groupware Webmail is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2020-8035

Affected software: Horde Groupware Webmail Edition. Vulnerability: stored XSS via SVG image uploads, enabling a remote attacker to obtain access to a victim’s webmail account. Affected versions are Horde Groupware Webmail Edition prior to 5.2.22. Risk details are stated in the connected documents...

DEBIAN-CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

openstack-manila: User with share-network UUID is able to show, create and delete shares

An access flaw was found in openstack-manila, where the API did not validate the user/project on commands. A malicious user having the UUID of a share-network could view, update, delete, or share resources that did not belong to them. Attackers could also create resources on shared networks for...

MongoDB Ops Manager Information Disclosure Vulnerability

MongoDB Ops Manager is a MongoDB USA solution that supports managing, monitoring and backing up MongoDB deployments. A security vulnerability exists in MongoDB Ops Manager versions 4.0.9, 4.0.10, and 4.1.5. An attacker could exploit the vulnerability to view specific access logs for publicly...

CVE-2019-2388

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5...

Dream CMS LmxCMS has an arbitrary file deletion vulnerability

LmxCMS is developed using php language and mysql database, and adopts the mainstream MVC design model. Dream CMS LmxCMS has an arbitrary file deletion vulnerability that can be exploited by attackers to cause arbitrary file deletion...

CVE-2020-8159

There is a vulnerability in actionpackpage-caching gem v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view...

CVE-2020-12765

Solis Miolo 2.0 allows index.php?module=install&action=view&item= Directory Traversal...

DRUPAL-CONTRIB-2020-016

This webform module enables you to build 'Term select' and 'Term checkboxes' elements. The module doesn't sufficiently check term 'view' access when rendering the 'Term select' and 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term select' and 'Term checkboxes' elements...

PT-2020-12810 · Algolplus · Algolplus Advanced Order Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: AlgolPlus Advanced Order Export For WooCommerce plugin version 3.1.3 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the woe post type parameter in the "view/settings-form.php"...

Octopus Deploy Information Disclosure Vulnerability (CNVD-2020-27449)

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy versions prior to 2019.12.9 and 2020.1.12. An attacker could use the vulnerability to view server tasks that only...

sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference or incorrect results...

FreeBSD : Wagtail -- XSS vulnerability (8d85d600-84a9-11ea-97b9-08002728f74c)

Wagtail release notes : CVE-2020-11001: Possible XSS attack via page revision comparison view This release addresses a cross-site scripting XSS vulnerability on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail...

MITRE ATT&CK APT 29 evaluation proves Microsoft Threat Protection provides deeper end to end view of advanced threats

As attackers use more advanced techniques, it’s even more important that defenders have visibility not just into each of the domains in their environment, but also across them to piece together coordinated, targeted, and advanced attacks. This level of visibility will allow us to get ahead of...