| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2020-29475 | 3.5 | nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XS | 2020-12-30 16:42:00 | 2020-12-29 15:15:00 |
| CVE-2020-35766 | 4.4 | The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack against the /tmp/testkeys file (related to t-testdata.h, t-setup.c, and t-cleanup.c). NOTE: this is applicable to persons who choose t | 2020-12-30 16:38:00 | 2020-12-28 20:15:00 |
| CVE-2020-25847 | 6.5 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. | 2020-12-30 16:15:00 | 2020-12-29 07:15:00 |
| CVE-2020-26286 | 5.0 | HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in H | 2020-12-30 16:14:00 | 2020-12-29 00:15:00 |
| CVE-2020-28093 | 6.5 | On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234. | 2020-12-30 16:14:00 | 2020-12-28 07:15:00 |
| CVE-2020-35711 | 5.0 | An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling | 2020-12-30 16:00:00 | 2020-12-25 23:15:00 |
| CVE-2020-35710 | 5.0 | Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In ot | 2020-12-30 16:00:00 | 2020-12-25 19:15:00 |
| CVE-2020-26289 | 5.0 | date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2. | 2020-12-30 15:51:00 | 2020-12-28 19:15:00 |
| CVE-2020-35284 | 5.0 | Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation deta | 2020-12-30 15:50:00 | 2020-12-26 06:15:00 |
| CVE-2020-35362 | 5.0 | DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter (the attacker mus | 2020-12-30 15:49:00 | 2020-12-26 06:15:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: