CVEs published in October 2020
1,695 vulnerabilities, 205 critical, 15 exploited.
- samba, redhat enterprise linux +1 moreA flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC...6.5 Medium
- samba, debian linux, fedoraproject fedora +1 more +3 moreA null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15,...5.5 Medium
- samba, redhat enterprise linux, storage +2 moreA flaw was found in the way samba handled file and directory permissions. An authenticated user...4.3 Medium
- linux kernel, netapp a250 firmware, aff 500f firmware +3 more +5 moreAn out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323...8.1 High
- sonarsource sonarqube** DISPUTED ** SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and...7.5 High
- cyberark privileged session managerCyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal...2.6 Low
- getgophish gophishGophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.7.8 High
- getgophish gophishGophish through 0.10.1 does not invalidate the gophish cookie upon logout.7.5 High
- getgophish gophishThe Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack6.5 Medium
- getgophish gophishGophish vulnerable to Server-Side Request Forgery5.3 Medium
- getgophish gophishCross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.5.4 Medium
- getgophish gophishCross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.5.4 Medium
- getgophish gophishCross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.5.4 Medium
- qsc q-sys core managerAn issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on...7.5 High
- innogames god kingsThe God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called...5.5 Medium
- genexis platinum-4410 firmwareGenexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This...5.4 Medium
- citadel webcitA Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated...9.8 Critical
- citadel webcitAn Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows...6.5 Medium
- citadel webcitMultiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote...6.1 Medium
- citadel webcitCitadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users...5.3 Medium
- qnap qts, network attached storage (nas) +1 moreIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject...6.1 Medium
- qnap qts, network attached storage (nas) +1 moreIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary...9.8 Critical
- qnap qts, network attached storage (nas) +1 moreIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject...8.0 High
- sectona spectraSectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information...7.5 High
- winstonprivacy winston firmwareWinston 1.5.4 devices have an SSH user account with access from bastion hosts. This is...9.8 Critical
- winstonprivacy winston firmwareWinston 1.5.4 devices make use of a Monit service (not managed during the normal user process)...7.1 High
- winstonprivacy winston firmwareWinston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and...7.5 High
- winstonprivacy winston firmwareWinston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows...9.1 Critical
- winstonprivacy winston firmwareWinston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root...7.8 High
- winstonprivacy winston firmwareWinston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.6.8 Medium
- winstonprivacy winston firmwareThe API on Winston 1.5.4 devices is vulnerable to CSRF.8.8 High
aws-encryption-sdk-cliPyPICLI does not correctly implement strict modeNo score- winstonprivacy winston firmwareWinston 1.5.4 devices are vulnerable to command injection via the API.9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse...6.5 Medium
- ibm sterling connect direct for microsoft windows, sterling connect\ +1 moreIBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote...7.5 High
- shibboleth identity providerShibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote...7.5 High
- quadient mail accountingNeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.6.1 Medium
- oscommerceosCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.8.8 High
- oscommerceosCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php,...9.8 Critical
- snap7 project snap7The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP...7.5 High
- grafanaGrafana XSS via a query alias for the ElasticSearch datasource6.1 Medium
- pulsesecure pulse secure desktop clientA vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could...5.4 Medium
- ivanti connect secure, policy secure, pulsesecure pulse connect secure +1 more +3 moreA vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow...6.1 Medium
- ivanti connect secure, policy secure, pulsesecure pulse connect secure +1 more +3 moreA vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to...4.3 Medium
- ivanti connect secure, pulse connect secure +1 moreA vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an...7.2 High
- pulsesecure pulse secure desktop clientA vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a...7.5 High
- pulsesecure pulse secure desktop clientA vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an...4.9 Medium
- pulsesecure pulse secure desktop clientA vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry...9.8 Critical
- pulsesecure pulse secure desktop clientA vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if...8.8 High
- pulsesecure pulse secure desktop clientA vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an...7.8 High
- Show moreLoading…