Total
7102 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2010-3118 | 1 Google | 1 Chrome | 2020-08-04 | 5.0 MEDIUM | N/A |
| The autosuggest feature in the Omnibox implementation in Google Chrome before 5.0.375.127 does not anticipate entry of passwords, which might allow remote attackers to obtain sensitive information by reading the network traffic generated by this feature. | |||||
| CVE-2020-10945 | 1 Centreon | 2 Centreon, Widget-host-monitoring | 2020-08-03 | 3.3 LOW | 4.3 MEDIUM |
| Centreon before 19.10.7 exposes Session IDs in server responses. | |||||
| CVE-2018-1000549 | 1 Wekan Project | 1 Wekan | 2020-08-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request. | |||||
| CVE-2018-1999009 | 1 Octobercms | 1 October | 2020-08-03 | 6.8 MEDIUM | 8.1 HIGH |
| October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437. | |||||
| CVE-2010-3417 | 1 Google | 1 Chrome | 2020-07-31 | 5.0 MEDIUM | N/A |
| Google Chrome before 6.0.472.59 does not prompt the user before granting access to the extension history, which allows attackers to obtain potentially sensitive information via unspecified vectors. | |||||
| CVE-2019-4731 | 1 Ibm | 1 Mq Appliance | 2020-07-28 | 2.1 LOW | 5.5 MEDIUM |
| IBM MQ Appliance 9.1.4.CD could allow a local attacker to obtain highly sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 172616. | |||||
| CVE-2009-3097 | 2 Hp, Microsoft | 2 Performance Insight, Windows | 2020-07-28 | 7.8 HIGH | N/A |
| Multiple unspecified vulnerabilities in HP Performance Insight 5.3 on Windows allow attackers to obtain sensitive information via unknown vectors, as demonstrated by certain modules in VulnDisco Pack Professional 8.11. NOTE: as of 20090903, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. | |||||
| CVE-2011-1503 | 3 Liferay, Linux, Microsoft | 3 Liferay Portal, Linux Kernel, Windows 7 | 2020-07-23 | 3.5 LOW | N/A |
| The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL. | |||||
| CVE-2011-1502 | 1 Liferay | 1 Liferay Portal | 2020-07-23 | 4.0 MEDIUM | N/A |
| Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue. | |||||
| CVE-2020-7696 | 1 React-native-fast-image Project | 1 React-native-fast-image | 2020-07-22 | 5.0 MEDIUM | 5.3 MEDIUM |
| This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers. | |||||
| CVE-2020-4361 | 1 Ibm | 1 Planning Analytics | 2020-07-22 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766. | |||||
| CVE-2018-8890 | 1 Blackberry | 1 Unified Endpoint Manager | 2020-07-15 | 5.0 MEDIUM | 7.5 HIGH |
| An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user. | |||||
| CVE-2018-8580 | 1 Microsoft | 1 Sharepoint Server | 2020-07-14 | 4.3 MEDIUM | 4.3 MEDIUM |
| An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF), aka "Microsoft SharePoint Information Disclosure Vulnerability." This affects Microsoft SharePoint. | |||||
| CVE-2018-20307 | 1 Pulsesecure | 1 Virtual Traffic Manager | 2020-07-14 | 4.0 MEDIUM | 4.3 MEDIUM |
| Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation. | |||||
| CVE-2016-8507 | 1 Yandex | 1 Yandex Browser | 2020-07-09 | 4.3 MEDIUM | 6.5 MEDIUM |
| Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initiate facetime-call without user's approval and obtain video and audio data from a device via a crafted web site. | |||||
| CVE-2020-11013 | 1 Helm | 1 Helm | 2020-07-06 | 4.0 MEDIUM | 5.0 MEDIUM |
| Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0 | |||||
| CVE-2020-15081 | 1 Prestashop | 1 Prestashop | 2020-07-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory. | |||||
| CVE-2020-4565 | 1 Ibm | 1 Spectrum Protect Plus | 2020-07-01 | 4.3 MEDIUM | 5.9 MEDIUM |
| IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the application and server. IBM X-Force ID: 183935. | |||||
| CVE-2020-13264 | 1 Gitlab | 1 Gitlab | 2020-06-26 | 5.0 MEDIUM | 5.3 MEDIUM |
| Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token | |||||
| CVE-2017-18887 | 1 Mattermost | 1 Mattermost Server | 2020-06-26 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members. | |||||