An issue was discovered in FastReport before 2020.4.0. It lacks a ScriptSecurity feature and therefore may mishandle (for example) GetType, typeof, TypeOf, DllImport, LoadLibrary, and GetProcAddress.
Max CVSS
9.8
EPSS Score
0.51%
Published
2020-10-29
Updated
2021-07-21
An issue was discovered in SmartStoreNET before 4.0.1. It does not properly consider the need for a CustomModelPartAttribute decoration in certain ModelBase.CustomProperties situations.
Max CVSS
8.8
EPSS Score
0.35%
Published
2020-10-29
Updated
2021-03-04
SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter.
Max CVSS
9.8
EPSS Score
13.13%
Published
2020-10-29
Updated
2020-11-03
Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.
Max CVSS
5.3
EPSS Score
7.31%
Published
2020-10-29
Updated
2020-11-03
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.
Max CVSS
7.5
EPSS Score
25.38%
Published
2020-10-28
Updated
2024-03-21
Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users.
Max CVSS
5.4
EPSS Score
0.12%
Published
2020-10-28
Updated
2020-11-04
Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session.
Max CVSS
7.5
EPSS Score
0.21%
Published
2020-10-28
Updated
2022-02-08
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option.
Max CVSS
10.0
EPSS Score
2.67%
Published
2020-10-28
Updated
2020-10-29
osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.
Max CVSS
8.8
EPSS Score
0.11%
Published
2020-10-28
Updated
2020-10-29
NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.
Max CVSS
6.1
EPSS Score
0.09%
Published
2020-10-28
Updated
2020-12-02
The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.
Max CVSS
5.4
EPSS Score
0.06%
Published
2020-10-28
Updated
2020-11-04
An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=manage_car because .php files can be uploaded to admin/assets/uploads/ (under the web root).
Max CVSS
9.8
EPSS Score
4.86%
Published
2020-10-28
Updated
2020-11-03
The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZCL Discover Commands Received Response message or a ZCL Discover Commands Generated Response message. It crashes in zclParseInDiscCmdsRspCmd().
Max CVSS
7.5
EPSS Score
0.12%
Published
2020-10-27
Updated
2020-11-10
The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZCL Read Reporting Configuration Response message. It crashes in zclHandleExternal().
Max CVSS
7.5
EPSS Score
0.12%
Published
2020-10-27
Updated
2021-07-21
The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZCL Write Attributes No Response message. It crashes in zclParseInWriteCmd() and does not update the specific attribute's value.
Max CVSS
8.2
EPSS Score
0.12%
Published
2020-10-27
Updated
2021-07-21
An issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi Controller 6.0.28 devices. Cached credentials are not erased from an access point returning wirelessly from a disconnected state. This may provide unintended network access.
Max CVSS
7.5
EPSS Score
0.17%
Published
2020-10-27
Updated
2021-07-21
An issue was discovered in EyesOfNetwork 5.3 through 5.3-8. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the nmap_binary parameter to lilac/autodiscovery.php.
Max CVSS
9.0
EPSS Score
0.19%
Published
2020-10-29
Updated
2021-02-23
An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the username_available function of the includes/functions.php file (which is called by login.php).
Max CVSS
9.8
EPSS Score
0.17%
Published
2020-10-29
Updated
2021-02-23
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s password and invalidate the session of the victim while the hacker maintains access.
Max CVSS
6.1
EPSS Score
0.11%
Published
2020-10-29
Updated
2020-11-03
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.
Max CVSS
9.8
EPSS Score
0.80%
Published
2020-10-27
Updated
2020-12-07
An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator (4 digits), a remote attacker has the opportunity to conduct a brute force attack on this PIN code. As result, remote attacker retrieves all passwords from another systems, available for affected account.
Max CVSS
6.8
EPSS Score
0.23%
Published
2020-10-29
Updated
2021-07-21
An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation of privileges.
Max CVSS
10.0
EPSS Score
1.62%
Published
2020-10-29
Updated
2021-12-06
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
Max CVSS
9.8
EPSS Score
0.22%
Published
2020-10-26
Updated
2020-11-02
An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Max CVSS
6.5
EPSS Score
0.16%
Published
2020-10-28
Updated
2020-11-04
Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Max CVSS
6.1
EPSS Score
0.17%
Published
2020-10-28
Updated
2020-11-04
1563 vulnerabilities found
1 2 3 4 5 6 ...... 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!