|
196421
|
8.8 |
HIGH
Network
|
testlink
|
testlink
|
An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection.
|
CWE-89
SQL Injection
|
CVE-2020-8841
|
2024-11-21 14:39 |
2020-02-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196422
|
9.8 |
CRITICAL
Network
|
fasterxml debian netapp huawei oracle
|
jackson-databind debian_linux steelstore_cloud_integrated_storage oncommand_workflow_automation service_level_manager oncommand_api_services oceanstor_9000_firmware global_lifecy…
|
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2020-8840
|
2024-11-21 14:39 |
2020-02-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196423
|
5.4 |
MEDIUM
Network
|
vanillaforums
|
vanilla
|
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
|
CWE-79
Cross-site Scripting
|
CVE-2020-8825
|
2024-11-21 14:39 |
2020-02-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196424
|
6.1 |
MEDIUM
Network
|
sockjs_project
|
sockjs
|
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
|
CWE-79
Cross-site Scripting
|
CVE-2020-8823
|
2024-11-21 14:39 |
2020-02-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196425
|
4.8 |
MEDIUM
Network
|
digi
|
transport_wr21_firmware transport_wr44_firmware
|
Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
|
CWE-79
Cross-site Scripting
|
CVE-2020-8822
|
2024-11-21 14:39 |
2020-02-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196426
|
5.4 |
MEDIUM
Network
|
bludit
|
bludit
|
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug.
|
CWE-79
Cross-site Scripting
|
CVE-2020-8812
|
2024-11-21 14:39 |
2020-02-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196427
|
4.3 |
MEDIUM
Network
|
bludit
|
bludit
|
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.
|
CWE-862
Missing Authorization
|
CVE-2020-8811
|
2024-11-21 14:39 |
2020-02-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196428
|
7.8 |
HIGH
Local
|
corsair
|
icue
|
The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to read and write to arbitrary ph…
|
NVD-CWE-noinfo
|
CVE-2020-8808
|
2024-11-21 14:39 |
2020-02-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196429
|
9.8 |
CRITICAL
Network
|
biscom
|
secure_file_transfer
|
Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.
|
NVD-CWE-Other
|
CVE-2020-8796
|
2024-11-21 14:39 |
2020-02-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196430
|
6.1 |
MEDIUM
Network
|
synaptivemedical
|
clearcanvas
|
Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product ca…
|
CWE-79
Cross-site Scripting
|
CVE-2020-8788
|
2024-11-21 14:39 |
2020-02-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|