Security Vulnerabilities - CVEs Published In 2020
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
CVSS Score
6.5
EPSS Score
0.011
Published
2020-07-22
A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
CVSS Score
7.8
EPSS Score
0.011
Published
2020-07-22
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
CVSS Score
8.8
EPSS Score
0.219
Published
2020-07-22
Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
CVSS Score
6.1
EPSS Score
0.351
Published
2020-07-22
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004.
CVSS Score
5.1
EPSS Score
0.002
Published
2020-07-22
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008.
CVSS Score
4.0
EPSS Score
0.003
Published
2020-07-22
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009
CVSS Score
6.2
EPSS Score
0.003
Published
2020-07-22
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 179266.
CVSS Score
6.8
EPSS Score
0.012
Published
2020-07-22
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 179428.
CVSS Score
6.8
EPSS Score
0.006
Published
2020-07-22
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. IBM X-Force ID: 179476.
CVSS Score
6.5
EPSS Score
0.011
Published
2020-07-22