CVEs published in September 2020
1,908 vulnerabilities, 200 critical, 8 exploited.
- gnupg, gpg4win +1 moreGnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or...7.8 High
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile...4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff...4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in...4.8 Medium
quillnpmReverse Tabnabbing in quill6.5 Medium- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.4.8 Medium
- vbulletinThe Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.4.8 Medium
takeapeeknpmCross-Site Scripting in takeapeekNo scorejquery.json-viewernpmCross-Site Scripting in jquery.json-viewerNo scorerestify-swagger-jsdocnpmPath Traversal in restify-swagger-jsdocNo score- chadhaajay phpkbAn issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php ...7.5 High
zencashjsnpmUndefined Behavior in zencashjsNo scorebleachnpmCross-Site Scripting in bleachNo scoresafe-evalnpmSandbox Breakout / Arbitrary Code Execution in safe-evalNo scoreapostrophenpmOpen Redirect in apostropheNo scoregraylog-web-interfacenpmCross-Site Scripting in graylog-web-interfaceNo scorezeronpmPath Traversal in zeroNo scoreeconpmCross-Site Scripting in ecoNo score@ionic/corenpmCross-Site Scripting in @ionic/coreNo scorelocal-devicesnpmCommand Injection in local-devicesNo score@berslucas/liljsnpmCross-Site Scripting in @berslucas/liljs6.5 Mediumrequire-nodenpmArbitrary Code Execution in require-nodeNo score- xuxueli xxl-jobxxl-job Multiple cross-site scripting (XSS) vulnerabilities6.1 Medium
- xuxueli xxl-jobxxl-job sensitive data exposure7.5 High
file-static-servernpmPath Traversal in file-static-serverNo scoreputnpmSensitive Data Exposure in putNo score- pull it project itpullit vulnerable to command injection9.8 Critical
ponsenpmPath Traversal in ponseNo scorebrutesernpmPath Traversal in bruteserNo score- advanced reports project reportssilverstripe-advancedreports vulnerable to XSS6.1 Medium
- tencentThe Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL...7.8 High
- 163 netease mail masterGuangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers...7.8 High
- tencent timShenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be...7.8 High
- 163 netease youdao dictionaryNetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers...7.8 High
- 360 speed browser360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by...7.8 High
- pancakeapp pancakeUse of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge...9.8 Critical
@sap-cloud-sdk/corenpmImproper Authorization in @sap-cloud-sdk/coreNo score- snapappointments bootstrap-selectCross-site scripting in bootstrap-select6.1 Medium
@toast-ui/editornpmCross-Site Scripting in @toast-ui/editorNo scorenode-weakauras-parsernpmBuffer Overflow in node-weakauras-parserNo scoresappernpmPath Traversal in sapperNo scorehtmrnpmCross-Site Scripting in htmrNo scorelazysizesnpmCross-Site Scripting in lazysizesNo scorepriest-runnernpmCommand Injection in priest-runnerNo scorereact-oauth-flownpmImproper Authorization in react-oauth-flowNo score- Show moreLoading…