Weekly Digest: a new vulnerability is published on the National Vulnerability Database (24 items)

New vulnerabilities from the NVD: CVE-2017-18113 The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and other Jira dependencies. Atlassian-made functions or functions provided by 3rd party plugins are not affected by this fix. Published at: August 02, 2021 at 06:15AM View on website August 02, 2021 at 08:34AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-14453 An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges (installer or administrator) for the graphical interface via a 1C000000000S value for domus, in conjunction with a zero value for logged. Published at: August 03, 2021 at 09:15PM View on website August 03, 2021 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19305 An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges. Published at: August 04, 2021 at 01:15AM View on website August 04, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19304 An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information. Published at: August 04, 2021 at 01:15AM View on website August 04, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19303 An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file. Published at: August 04, 2021 at 01:15AM View on website August 04, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19302 An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to ".php". Published at: August 04, 2021 at 01:15AM View on website August 04, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19301 A vulnerability in the vae_admin_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in the condition parameter. Published at: August 04, 2021 at 01:15AM View on website August 04, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-24823 A vulnerability in the dwarf::to_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Published at: August 04, 2021 at 06:15PM View on website August 04, 2021 at 07:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-24822 A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Published at: August 04, 2021 at 06:15PM View on website August 04, 2021 at 07:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-24821 A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file. Published at: August 04, 2021 at 06:15PM View on website August 04, 2021 at 07:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-22352 The gf_dash_segmenter_probe_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. Published at: August 05, 2021 at 12:15AM View on website August 05, 2021 at 01:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-22732 CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker.. Published at: August 05, 2021 at 08:15PM View on website August 05, 2021 at 09:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2021-1630 XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers. Published at: August 06, 2021 at 12:15AM View on website August 06, 2021 at 01:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-7863 A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy. Published at: August 06, 2021 at 12:15AM View on website August 06, 2021 at 01:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-22392 Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. Published at: August 06, 2021 at 01:15AM View on website August 06, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-22330 Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. Published at: August 06, 2021 at 05:15PM View on website August 06, 2021 at 07:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-18694 Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profile/save_profile". Published at: August 06, 2021 at 10:15PM View on website August 06, 2021 at 11:34PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-18693 Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'. Published at: August 06, 2021 at 10:15PM View on website August 06, 2021 at 11:34PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28088 An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code. Published at: August 07, 2021 at 02:15AM View on website August 07, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28087 A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database information. Published at: August 07, 2021 at 02:15AM View on website August 07, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-21358 A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users. Published at: August 07, 2021 at 02:15AM View on website August 07, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-21357 A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field. Published at: August 07, 2021 at 02:15AM View on website August 07, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-21356 An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is deleted during file uploads. Published at: August 07, 2021 at 02:15AM View on website August 07, 2021 at 03:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-21353 A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module. Published at: August 07, 2021 at 02:15AM View on website August 07, 2021 at 03:33AM via National Vulnerability Database