CVE-2020-7575

A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitra...

Cross site scripting

A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitra...

CVE-2020-7575

A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitra...

CVE-2020-7575

The CVE-2020-7575 entry affects Siemens Climatix POL908 (BACnet/IP module) and POL909 (AWM module). The vulnerability is a persistent cross-site scripting (XSS) flaw in the web server access log page that lets an attacker inject arbitrary JavaScript via specially crafted GET requests. Exploitatio...

buildah: Crafted input tar file may lead to local file overwrite during image build process

A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTPs server and then write files to the user's system anywhere that the user has permissions...

buildah: Crafted input tar file may lead to local file overwrite during image build process

A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTPs server and then write files to the user's system anywhere that the user has permissions...

Denial Of Service (DoS)

JBoss Web Server is vulnerable to a denial of service. Due to a flaw in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause JBoss Web Server to hang via a specially-crafted HTTP request...

OS Command Injection

cacti is vulnerable to OS command injection. Multiple command injection flaws were discovered in Cacti. An authenticated user with certain administrative privileges could use these flaws to execute arbitrary commands on the Cacti server with the privileges of the web server user...

Cross-site Scripting (XSS)

The Common UNIX Printing System CUPS is vulnerable to Cross-site Scripting XSS. Several cross-site scripting XSS flaws were found in the way the CUPS web server interface processed HTML form content. If a remote attacker could trick a local user who is logged into the CUPS web interface into...

Arbitrary Code Execution

squirrelmail is vulnerable to arbitrary code execution. The vulnerability exists as a server-side code injection flaw was found in the SquirrelMail "mapypalias" function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service NIS server via the...

Arbitrary Code Execution

squirrelmail is vulnerable to arbitrary code execution. A local file disclosure flaw was found in the way SquirrelMail loads plugins. If registerglobals is on and magicquotesgpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web...

Arbitrary Code Execution

mozilla nss is vulnerable to arbitrary code execution. Two buffer overflow flaws were found in the Network Security Services NSS code for processing the SSLv2 protocol. Connecting to a malicious secure web server could cause the execution of arbitrary code as the user running Thunderbird...

The vulnerability of Engine.IO’s WebSocket server protocol, related to the manipulation of cross-site requests, allows attackers to perform arbitrary actions on the vulnerable system.

The vulnerability of the WebSocket protocol in the Engine.IO web server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable system remotely...

python security update

CentOS Errata and Security Advisory CESA-2020:1091 An update for python-twisted-web is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...

CVE-2020-6974

Honeywell Notifier Web Server NWS Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem...

CVE-2020-6974

Honeywell Notifier Web Server NWS Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem...

Path traversal

Honeywell Notifier Web Server NWS Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem...

CVE-2020-6974

Honeywell Notifier Web Server NWS Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem...

CVE-2020-6974

Honeywell Notifier Web Server NWS Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem...

CVE-2020-6974

The CVE-2020-6974 issue affects Honeywell Notifier Web Server (NWS) versions 3.50 and earlier, where a path traversal vulnerability can bypass access to restricted directories. Multiple sources corroborate the vulnerability and indicate a firmware update from Honeywell addresses the problem. CISA...