Page 3 of 26 results (0.036 seconds)

CVSS: 7.8EPSS: 93%CPEs: 11EXPL: 5

CVE-2020-28949 – PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

https://notcve.org/view.php?id=CVE-2020-28949

19 Nov 2020 — Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Archive_Tar versiones hasta 1.4.10, presenta una desinfección del nombre de archivo :// solo para abordar los ataques phar y, por lo tanto, cualquier otro ataque de empaquetado de flujo (tal y como file:// para sobrescribir archivos) aún puede tener éxito A flaw was found in the Archive_Tar package. PEAR Archive_Tar could allo... • https://packetstorm.news/files/id/161095 • CWE-20: Improper Input Validation CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2020-13663 – Debian Security Advisory 4706-1

https://notcve.org/view.php?id=CVE-2020-13663

28 Jun 2020 — Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. Una vulnerabilidad de tipo Cross Site Request Forgery en la API de Drupal Core Form no maneja apropiadamente determinadas entradas de formularios de peticiones de tipo cross-site, lo que puede conllevar a otras vulnerabilidades It was discovered that Drupal, a fully-featured content management framework, was suspectible to cross site ... • https://www.drupal.org/sa-core-2020-004 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-6342 – Drupal core - Critical - Access bypass - SA-CORE-2019-008

https://notcve.org/view.php?id=CVE-2019-6342

28 May 2020 — An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. Se presenta una vulnerabilidad de omisión de acceso cuando el módulo de Workspaces experimental en el core de Drupal versión 8 está habilitado. Esto puede mitigarse deshabilitando el módulo Workspaces. • https://www.drupal.org/sa-core-2019-008 •

CVSS: 6.9EPSS: 2%CPEs: 206EXPL: 6

CVE-2020-11022 – Potential XSS vulnerability in jQuery

https://notcve.org/view.php?id=CVE-2020-11022

29 Apr 2020 — In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. En las versiones de jQuery mayores o iguales a 1.2 y anteriores a la versión 3.5.0, se puede ejecutar HTML desde fuentes no seguras, incluso después de desinfectarlo, a uno de los métodos de manipulación DOM de jQuery (es decir .h... • https://packetstorm.news/files/id/162159 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 11%CPEs: 81EXPL: 8

CVE-2020-11023 – JQuery Cross-Site Scripting (XSS) Vulnerability

https://notcve.org/view.php?id=CVE-2020-11023

29 Apr 2020 — In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing

CVSS: 6.1EPSS: 1%CPEs: 24EXPL: 0

CVE-2020-9281 – Ubuntu Security Notice USN-5340-1

https://notcve.org/view.php?id=CVE-2020-9281

07 Mar 2020 — A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax). Una vulnerabilidad de tipo cross-site scripting (XSS) en el HTML Data Processor for CKEditor versiones 4.0 anteriores a 4.14, permite a atacantes remotos inyectar script web arbitrario por medio de un comentario "protected" diseñado (con la sintaxis cke_protected). Kyaw Min Thein discov... • https://github.com/ckeditor/ckeditor4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •