CVEs published in September 2020
1,908 vulnerabilities, 200 critical, 8 exploited.
- gitlab An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was... 4.0 Medium
- rainbowfishsoftware pacsone server RainbowFish PacsOne Server 6.8.4 allows XSS. 5.4 Medium
- apache superset Plaintext password leak in Apache Superset 8.1 High
- fatek winproladder, fatek automation plc winproladder +1 more FATEK Automation PLC WinProladder 7.8 High
- rainbowfishsoftware pacsone server RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control. 8.8 High
- rainbowfishsoftware pacsone server RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page. 9.8 Critical
- eaton 9000x programming and configuration software DLL Hijacking 7.8 High
- mantisbt MantisBT HTML Injection vulnerability 4.8 Medium
- mantisbt MantisBT unauthorized users able to access private files 4.3 Medium
- mantisbt MantisBT XXS where a Custom Field with a crafted Regular Expression property is used 4.8 Medium
- hashicorp vault Token leases could outlive their TTL in HashiCorp Vault 6.8 Medium
- encode django rest framework, debian linux, redhat ceph storage +2 more Cross-site Scripting (XSS) in Django REST Framework 6.1 Medium
- re-desk re\ Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class... 7.2 High
- re-desk re\ Re:Desk 2.3 allows insecure file upload. 7.5 High
- re-desk re\ Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria()... 9.8 Critical
- alibaba nacos Incorrect Access Control in Nacos 5.3 Medium
- apple exposure notifications An issue was discovered in the GAEN (aka Google Apple Encounter Notification) protocol through... 5.7 Medium
- niushop Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the... 9.8 Critical
- qualcomm atheros ar9132 firmware, atheros ar9283 firmware, atheros ar9285 firmware +2 more A partial authentication bypass vulnerability exists on Atheros AR9132 3.60(AMX.8), AR9283 1.85,... 6.1 Medium
- realtek rtl8192er firmware, rtl8196d firmware, rtl8812ar firmware +1 more +3 more A partial authentication bypass vulnerability exists on Realtek RTL8812AR 1.21WW, RTL8196D 1.0.0,... 6.1 Medium
- mediatek mt7620n firmware A partial authentication bypass vulnerability exists on Mediatek MT7620N 1.06 devices. The... 6.1 Medium
- apache openmeetings Denial of service in Apache OpenMeetings 7.5 High
- niushop In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing... 4.9 Medium
- apache hadoop Improper Authentication in Apache Hadoop 7.5 High
- apache tapestry Improper file downloads in Apache Tapestry 5.3 Medium
- wago 750-362, 750-363, 750-823 +11 more +13 more WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03 9.1 Critical
- wago 750-831/xxx-xxx, 750-852, 750-880/xxx-xxx +11 more +13 more WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07 8.2 High
- pluck-cms pluck An issue was discovered in Pluck CMS v4.7.11. There is a file upload vulnerability that can cause... 8.8 High
- bigbluebutton greenlight BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can... 8.8 High
- halo There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the... 7.7 High
- halo An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the... 9.8 Critical
- halo Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1... 7.5 High
- ibm websphere application server IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized... 2.9 Low
- halo There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing... 9.1 Critical
- halo A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme... 9.8 Critical
- halo An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the... 9.8 Critical
- frontaccounting An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability... 4.9 Medium
- august connect firmware, home, connect wi-fi bridge firmware +1 more +3 more Use of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge App 3.5 Low
- jwt-go project jwt-go Authorization bypass in github.com/dgrijalva/jwt-go 7.5 High
- hack hfish An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered,... 6.1 Medium
- handlebarsjs handlebars Regular Expression Denial of Service in Handlebars 7.5 High
- linuxfoundation nats.deno, nats.js, nats.ws +2 more Sensitive data exposure in NATS 7.5 High
- bitdefender engines Local Privilege Escalation in Bitdefender Engines (VA-8953) 3.2 Low
- sonicwall sma100, sma1000, sma100 firmware +1 more +3 more SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to... 5.3 Medium
- leanote Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing.... 9.6 Critical
- leanote Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch... 9.6 Critical
- cmsmadesimple cms made simple CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager... 5.4 Medium
-
libzmqOSS-Fuzz Heap-buffer-overflow in zmq::tcp_read No score - libproxy project libproxy, debian linux, fedoraproject fedora +1 more +3 more url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as... 9.8 Critical
- logaritmo aware callmanager info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive... 7.5 High
- Show olderLoading…