|
211851
|
4.3 |
MEDIUM
Network
|
tangro
|
business_workflow
|
An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid document ID and token. No further authenticati…
|
CWE-306
CWE-639
Missing Authentication for Critical Function
Authorization Bypass Through User-Controlled Key
|
CVE-2020-26173
|
2024-11-21 14:19 |
2020-12-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211852
|
6.5 |
MEDIUM
Network
|
tangro
|
business_workflow
|
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration …
|
CWE-294
Authentication Bypass by Capture-replay
|
CVE-2020-26172
|
2024-11-21 14:19 |
2020-12-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211853
|
4.3 |
MEDIUM
Network
|
tangro
|
business_workflow
|
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do n…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2020-26171
|
2024-11-21 14:19 |
2020-12-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211854
|
9.8 |
CRITICAL
Network
|
fleetdm
|
fleet
|
Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted d…
|
CWE-290
Authentication Bypass by Spoofing
|
CVE-2020-26276
|
2024-11-21 14:19 |
2020-12-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211855
|
8.8 |
HIGH
Network
|
systeminformation
|
systeminformation
|
In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
|
CWE-78
OS Command
|
CVE-2020-26274
|
2024-11-21 14:19 |
2020-12-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211856
|
6.1 |
MEDIUM
Network
|
dell
|
idrac9_firmware
|
Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vuln…
|
CWE-79
Cross-site Scripting
|
CVE-2020-26198
|
2024-11-21 14:19 |
2020-12-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211857
|
5.2 |
MEDIUM
Local
|
linuxfoundation
|
osquery
|
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb, someone with administrative access to o…
|
CWE-77
Command Injection
|
CVE-2020-26273
|
2024-11-21 14:19 |
2020-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211858
|
6.8 |
MEDIUM
Network
|
xstream_project
debian
fedoraproject
|
xstream
debian_linux
fedora
|
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerabi…
|
-
|
CVE-2020-26259
|
2024-11-21 14:19 |
2020-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211859
|
7.7 |
HIGH
Network
|
xstream_project
debian
fedoraproject
|
xstream
debian_linux
fedora
|
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerabil…
|
-
|
CVE-2020-26258
|
2024-11-21 14:19 |
2020-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211860
|
5.3 |
MEDIUM
Network
|
wireshark
fedoraproject
debian
oracle
|
wireshark
fedora
debian_linux
zfs_storage_appliance_kit
|
Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
|
CWE-125
Out-of-bounds Read
|
CVE-2020-26421
|
2024-11-21 14:19 |
2020-12-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
