CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1351 CVE-2020-8090 79 XSS 2020-01-27 2020-01-29
3.5
None Remote Medium ??? None Partial None
The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator login).
1352 CVE-2020-8089 79 XSS 2020-02-10 2020-02-14
3.5
None Remote Medium ??? None Partial None
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
1353 CVE-2020-8031 79 XSS 2021-02-11 2021-02-17
3.5
None Remote Medium ??? None Partial None
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prior to 2.10.8.
1354 CVE-2020-8030 377 2021-02-11 2021-02-19
3.6
None Local Low Not required Partial Partial None
A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.
1355 CVE-2020-8017 362 2020-04-02 2020-06-13
3.3
None Local Medium Not required None Partial Partial
A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.
1356 CVE-2020-7937 79 XSS 2020-01-23 2020-01-24
3.5
None Remote Medium ??? None Partial None
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.
1357 CVE-2020-7934 79 XSS 2020-01-28 2020-11-23
3.5
None Remote Medium ??? None Partial None
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.
1358 CVE-2020-7932 200 +Info 2020-06-17 2020-06-24
3.5
None Remote Medium ??? Partial None None
OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.
1359 CVE-2020-7921 863 Bypass 2020-05-06 2020-07-07
3.5
None Remote Medium ??? None Partial None
Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects: MongoDB Inc. MongoDB Server 4.2 versions prior to 4.2.3; 4.0 versions prior to 4.0.15; 4.3 versions prior to 4.3.3; 3.6 versions prior to 3.6.18.
1360 CVE-2020-7915 79 XSS 2020-01-22 2020-01-24
3.5
None Remote Medium ??? None Partial None
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
1361 CVE-2020-7910 79 XSS 2020-01-30 2020-01-31
3.5
None Remote Medium ??? None Partial None
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
1362 CVE-2020-7776 79 XSS 2020-12-09 2021-01-19
3.5
None Remote Medium ??? None Partial None
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
1363 CVE-2020-7747 79 XSS 2020-10-20 2020-10-22
3.5
None Remote Medium ??? None Partial None
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
1364 CVE-2020-7734 79 XSS 2020-09-22 2020-09-30
3.5
None Remote Medium ??? None Partial None
All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
1365 CVE-2020-7676 79 XSS 2020-06-08 2020-10-09
3.5
None Remote Medium ??? None Partial None
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
1366 CVE-2020-7642 79 XSS 2020-04-22 2020-05-01
3.5
None Remote Medium ??? None Partial None
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
1367 CVE-2020-7599 532 2020-03-30 2020-04-02
3.3
None Local Network Low Not required Partial None None
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.
1368 CVE-2020-7592 319 2020-07-14 2020-07-22
3.3
None Local Network Low Not required Partial None None
A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information.
1369 CVE-2020-7576 79 XSS 2020-07-14 2020-08-14
3.5
None Remote Medium ??? None Partial None
A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter Execution Core (V8.2). An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting (XSS) attacks within the vulnerable software. The impact of this attack could result in the session cookies of legitimate users being stolen. Should the attacker gain access to these cookies, they could then hijack the session and perform arbitrary actions in the name of the victim.
1370 CVE-2020-7571 79 XSS 2020-11-19 2020-11-27
3.5
None Remote Medium ??? None Partial None
A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users.
1371 CVE-2020-7570 79 XSS 2020-11-19 2020-11-27
3.5
None Remote Medium ??? None Partial None
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users.
1372 CVE-2020-7568 200 +Info 2020-11-19 2020-12-11
3.3
None Local Network Low Not required Partial None None
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
1373 CVE-2020-7546 79 XSS 2020-12-01 2020-12-04
3.5
None Remote Medium ??? None Partial None
A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.
1374 CVE-2020-7470 79 XSS 2020-01-21 2020-01-24
3.5
None Remote Medium ??? None Partial None
Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Password).
1375 CVE-2020-7453 754 2020-04-29 2020-05-06
3.3
None Local Medium Not required Partial Partial None
In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE-p7, a missing null termination check in the jail_set configuration option "osrelease" may return more bytes with a subsequent jail_get system call allowing a malicious jail superuser with permission to create nested jails to read kernel memory.
1376 CVE-2020-7333 79 XSS 2020-11-12 2020-11-23
3.5
None Remote Medium ??? None Partial None
Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard.
1377 CVE-2020-7324 269 Bypass 2020-09-09 2020-09-14
3.6
None Local Low Not required None Partial Partial
Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the SYSTEM folder via incorrectly applied permissions.
1378 CVE-2020-7310 269 2020-08-21 2020-10-19
3.3
None Local Medium Not required None Partial Partial
Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection (MTP) trial prior to 4.0.161.1 allows local users to change files that are part of write protection rules via manipulating symbolic links to redirect a McAfee file operations to an unintended file.
1379 CVE-2020-7309 79 XSS 2020-08-26 2020-09-02
3.5
None Remote Medium ??? None Partial None
Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.
1380 CVE-2020-7301 79 XSS 2020-08-12 2020-08-18
3.5
None Remote Medium ??? None Partial None
Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section.
1381 CVE-2020-7298 20 2020-08-05 2020-08-07
3.6
None Local Low Not required None Partial Partial
Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted object making a specific function call.
1382 CVE-2020-7282 59 2020-07-03 2020-10-19
3.3
None Local Medium Not required None Partial Partial
Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
1383 CVE-2020-7267 269 2020-05-08 2020-05-18
3.6
None Local Low Not required None Partial Partial
Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Linux prior to 2.0.3 Hotfix 2635000 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
1384 CVE-2020-7266 269 2020-05-08 2020-05-18
3.6
None Local Low Not required None Partial Partial
Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
1385 CVE-2020-7265 269 2020-05-08 2020-05-18
3.6
None Local Low Not required None Partial Partial
Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
1386 CVE-2020-7264 269 2020-05-08 2020-05-18
3.6
None Local Low Not required None Partial Partial
Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
1387 CVE-2020-7258 79 XSS 2020-03-18 2020-03-19
3.5
None Remote Medium ??? None Partial None
Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
1388 CVE-2020-7257 269 2020-04-15 2020-04-17
3.3
None Local Medium Not required None Partial Partial
Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links whilst an anti-virus scan was in progress. This is timing dependent.
1389 CVE-2020-7256 79 XSS 2020-03-18 2020-03-19
3.5
None Remote Medium ??? None Partial None
Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
1390 CVE-2020-7255 269 +Priv 2020-04-15 2020-04-21
3.6
None Local Low Not required None Partial Partial
Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to gain elevated privileges via ENS not checking user permissions when editing configuration in the ENS client interface. Administrators can lock the ENS client interface through ePO to prevent users being able to edit the configuration.
1391 CVE-2020-7249 79 XSS 2020-01-21 2020-01-27
3.5
None Remote Medium ??? None Partial None
SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the admin account).
1392 CVE-2020-7234 79 XSS 2020-01-19 2020-01-23
3.5
None Remote Medium ??? None Partial None
Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wireless X screen (after a successful login to the super account).
1393 CVE-2020-7228 79 XSS 2020-01-22 2020-01-24
3.5
None Remote Medium ??? None Partial None
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.
1394 CVE-2020-7132 79 XSS 2020-04-23 2020-04-30
3.5
None Remote Medium ??? None Partial None
A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE Onboard Administrator. * OA 4.95 (Linux and Windows).
1395 CVE-2020-7110 79 XSS 2020-04-16 2020-04-22
3.5
None Remote Medium ??? None Partial None
ClearPass is vulnerable to Stored Cross Site Scripting by allowing a malicious administrator, or a compromised administrator account, to save malicious scripts within ClearPass that could be executed resulting in a privilege escalation attack. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.
1396 CVE-2020-7068 416 2020-09-09 2021-02-25
3.3
None Local Medium Not required Partial None Partial
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
1397 CVE-2020-7050 79 XSS 2020-02-15 2020-02-20
3.5
None Remote Medium ??? None Partial None
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cookies and take over accounts.
1398 CVE-2020-7045 74 2020-01-16 2021-02-10
3.3
None Local Network Low Not required None None Partial
In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by validating opcodes.
1399 CVE-2020-7033 79 XSS 2020-11-13 2020-11-29
3.5
None Remote Medium ??? None Partial None
A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.10.
1400 CVE-2020-7020 269 2020-10-22 2020-11-23
3.5
None Remote Medium ??? Partial None None
Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.