Show filters
460 topics marked with the following tags:
Displaying 1-10 of 460
Sort by:
Attacker Value
Very High

CVE-2019-18393

Disclosure Date: October 24, 2019 (last updated October 06, 2023)
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
Attacker Value
High

CVE-2020-10535

Disclosure Date: March 12, 2020 (last updated October 06, 2023)
GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address.
Attacker Value
Very High

CVE-2019-18394

Disclosure Date: October 24, 2019 (last updated October 06, 2023)
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
Attacker Value
Unknown

CVE-2021-42574

Disclosure Date: November 01, 2021 (last updated November 08, 2023)
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements o…
Attacker Value
Very Low

CVE-2020-1296 Windows Diagnostics & feedback Information Disclosure Vulnerabili…

Disclosure Date: June 09, 2020 (last updated October 06, 2023)
A vulnerability exists in the way the Windows Diagnostics & feedback settings app handles objects in memory, aka 'Windows Diagnostics & feedback Information Disclosure Vulnerability'.
Attacker Value
Very High

CVE-2020-6364 — OS Command Injection Vulnerability in CA Introscope Enterprise …

Disclosure Date: October 15, 2020 (last updated October 07, 2023)
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.
Attacker Value
High

CVE-2021-26897

Disclosure Date: March 11, 2021 (last updated December 30, 2023)
Windows DNS Server Remote Code Execution Vulnerability
Attacker Value
High

CVE-2020-1206 Windows SMBv3 Client/Server Information Disclosure Vulnerability

Disclosure Date: June 09, 2020 (last updated October 06, 2023)
An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'.
Attacker Value
Very High

CVE-2020-10977

Disclosure Date: April 08, 2020 (last updated October 06, 2023)
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
Attacker Value
Very High

CVE-2020-4521

Disclosure Date: September 14, 2020 (last updated October 07, 2023)
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in Java. By sending specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 182396.