Security Vulnerabilities - CVEs Published In 2020
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.
CVSS Score
7.2
EPSS Score
0.276
Published
2020-06-11
Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.
CVSS Score
5.4
EPSS Score
0.01
Published
2020-06-11
Artica Pandora FMS 7.44 allows privilege escalation.
CVSS Score
9.8
EPSS Score
0.03
Published
2020-06-11
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.
CVSS Score
7.2
EPSS Score
0.276
Published
2020-06-11
Artica Pandora FMS 7.44 has inadequate access controls on a web folder.
CVSS Score
7.5
EPSS Score
0.022
Published
2020-06-11
An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Attackers with administrative access to the web interface have multiple options to escalate their privileges to the Unix root account.
CVSS Score
7.2
EPSS Score
0.026
Published
2020-06-11
An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman parameter of insufficient size could allow man-in-the-middle compromise of communications between CipherMail products and external SMTP clients.
CVSS Score
5.9
EPSS Score
0.01
Published
2020-06-11
The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the appliance, the user pydio is responsible for running all the services and binaries that are contained in the Pydio Cells web application package, such as mysqld, cells, among others. This user has privileges restricted to run those services and nothing more.
CVSS Score
7.0
EPSS Score
0.005
Published
2020-06-11
Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score
5.3
EPSS Score
0.014
Published
2020-06-11
In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.
CVSS Score
7.5
EPSS Score
0.022
Published
2020-06-11