Security Vulnerabilities - CVEs Published In 2020
An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.
CVSS Score
4.3
EPSS Score
0.022
Published
2020-09-30
In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application.
CVSS Score
8.0
EPSS Score
0.005
Published
2020-09-30
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.
CVSS Score
4.3
EPSS Score
0.013
Published
2020-09-30
Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
CVSS Score
7.5
EPSS Score
0.686
Published
2020-09-30
In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
CVSS Score
5.3
EPSS Score
0.027
Published
2020-09-30
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution.
CVSS Score
7.2
EPSS Score
0.018
Published
2020-09-30
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.
CVSS Score
5.4
EPSS Score
0.007
Published
2020-09-30
An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens
CVSS Score
6.5
EPSS Score
0.016
Published
2020-09-30
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue.
CVSS Score
4.3
EPSS Score
0.008
Published
2020-09-30
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.
CVSS Score
6.5
EPSS Score
0.01
Published
2020-09-30