🚨 CVE-2020-10824
A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).
🎖@cveNotify
A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).
🎖@cveNotify
🚨 CVE-2020-10825
A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).
🎖@cveNotify
A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).
🎖@cveNotify
🚨 CVE-2020-10826
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.
🎖@cveNotify
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.
🎖@cveNotify
🚨 CVE-2020-10827
A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
🎖@cveNotify
A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
🎖@cveNotify
🚨 CVE-2020-10828
A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
🎖@cveNotify
A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
🎖@cveNotify
🚨 CVE-2020-9467
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
🎖@cveNotify
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
🎖@cveNotify
GitHub
stored XSS with pwg.images.setInfo · Issue #1168 · Piwigo/Piwigo
on file param. No worry with an admin, but this method can be used by a community user as well. Originally reported by Zak S. see CVE-2020-9467
🚨 CVE-2020-9468
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
🎖@cveNotify
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
🎖@cveNotify
GitHub
[security] ability to by-pass protection on photo edition · Issue #49 · plegall/Piwigo-community
CVE-2020-9468 reported by Zak S. Further, a malicious user can modify the value of the 'image_id' parameter to any existing image id. There are no access controls to prevent a user from man...
🚨 CVE-2020-10990
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
🎖@cveNotify
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
🎖@cveNotify
GitHub
Merge pull request #14 from Accenture/security/xml-xxe-1-2020 · Accenture/mercury@f647a01
v1.12.28 with rest-automation improvements and XXE patch
🚨 CVE-2020-10991
Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
🎖@cveNotify
Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
🎖@cveNotify
GitHub
XXE in apikit · Issue #547 · mulesoft/apikit
While reading the code in the apikit project we (@n33dle and I) identified a vulnerability we wanted to raise. The vulnerability is an XXE vulnerability (https://owasp.org/www-community/vulnerabili...
🚨 CVE-2020-10992
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
🎖@cveNotify
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
🎖@cveNotify
GitHub
XXE in Azkaban · Issue #2478 · azkaban/azkaban
While reading the code in the Azkaban project we (@n33dle and I) identified a vulnerability we wanted to raise. The vulnerability is an XXE vulnerability (https://owasp.org/www-community/vulnerabil...
🚨 CVE-2020-10993
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
🎖@cveNotify
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
🎖@cveNotify
GitHub
XXE in Osmand · Issue #8711 · osmandapp/OsmAnd
While reading the code in the Osmand project we (@n33dle and I) identified a vulnerability we wanted to raise. The vulnerability is an XXE vulnerability (https://owasp.org/www-community/vulnerabili...
🚨 CVE-2020-3920
UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.
🎖@cveNotify
UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.
🎖@cveNotify
🚨 CVE-2020-3921
UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.
🎖@cveNotify
UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.
🎖@cveNotify
🚨 CVE-2020-3936
UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.
🎖@cveNotify
UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.
🎖@cveNotify
🚨 CVE-2020-10508
Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.
🎖@cveNotify
Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.
🎖@cveNotify
🚨 CVE-2020-10509
Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the system and launch XSS attack.
🎖@cveNotify
Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the system and launch XSS attack.
🎖@cveNotify
🚨 CVE-2020-10510
Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data.
🎖@cveNotify
Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data.
🎖@cveNotify
🚨 CVE-2020-1769
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
OTRS
OTRS Security Advisory 2020-06
March 27, 2020 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security@otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 uid OTRS Security…
🚨 CVE-2020-1770
Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
OTRS
OTRS Security Advisory 2020-07
March 27, 2020 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security@otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 uid OTRS Security…
🚨 CVE-2020-1771
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
OTRS
OTRS Security Advisory 2020-08
March 27, 2020 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security@otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 uid OTRS Security…
🚨 CVE-2020-1772
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
🎖@cveNotify
OTRS
OTRS Security Advisory 2020-09
March 27, 2020 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security@otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 uid OTRS Security…