|
211001
|
6.1 |
MEDIUM
Network
|
dolibarr
|
dolibarr_erp\/crm
|
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
|
CWE-79
Cross-site Scripting
|
CVE-2020-14475
|
2024-11-21 14:03 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211002
|
6.5 |
MEDIUM
Network
|
octopus
|
octopus_deploy
|
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password.
|
CWE-532
Inclusion of Sensitive Information in Log Files
|
CVE-2020-14470
|
2024-11-21 14:03 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211003
|
6.5 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001.
|
NVD-CWE-noinfo
|
CVE-2020-14460
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211004
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002.
|
CWE-20
Improper Input Validation
|
CVE-2020-14459
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211005
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004.
|
NVD-CWE-noinfo
|
CVE-2020-14458
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211006
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.
|
NVD-CWE-noinfo
|
CVE-2020-14457
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211007
|
7.3 |
HIGH
Network
|
mattermost
|
mattermost_desktop
|
An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006.
|
CWE-346
Origin Validation Error
|
CVE-2020-14456
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211008
|
6.5 |
MEDIUM
Network
|
mattermost
|
mattermost_desktop
|
An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007.
|
CWE-287
Improper Authentication
|
CVE-2020-14455
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211009
|
6.1 |
MEDIUM
Network
|
mattermost
|
mattermost_desktop
|
An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008.
|
CWE-601
Open Redirect
|
CVE-2020-14454
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211010
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005.
|
CWE-345
Insufficient Verification of Data Authenticity
|
CVE-2020-14453
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|