CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
Eos-1d_x_firmware, Eos-1d_x, Eos-1d_x_mkii_firmware, Eos-1d_x_mkii, Eos-1d_c_firmware, Eos-1d_c, Eos_5d_mark_iii_firmware, Eos_5d_mark_iii, Eos_5d_mark_iv_firmware, Eos_5d_mark_iv
2020-03-23
N/A
6.1 MEDIUM
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version.
Eos-1d_x_firmware, Eos-1d_x, Eos-1d_x_mkii_firmware, Eos-1d_x_mkii, Eos-1d_c_firmware, Eos-1d_c, Eos_5d_mark_iii_firmware, Eos_5d_mark_iii, Eos_5d_mark_iv_firmware, Eos_5d_mark_iv
2020-03-23
N/A
6.1 MEDIUM
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is map(template_name). NOTE: this is fixed in the latest version.
Session_border_controller_firmware, Session_border_controller, Restapps, Freepbx, Asterisk, Certified_asterisk, Freepbx_linux_7, Netborder/vega_session, Netborder/vega_session_firmware, Pbxact
2022-07-12
N/A
9.8 CRITICAL
The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command.
Docker Desktop allows local privilege escalation to NT AUTHORITYSYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0.
The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference.
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.
HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.
20007_office_system, 27mhz_wireless_keyboard, 365_apps, 3d_builder, 3d_viewer, Access, Accessibility_insights_for_android, Accessibility_insights_for_web, Access_multilingual_user_interface_pack, Active_directory
2021-07-21
N/A
7.8 HIGH
An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level.To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program.The update addresses the vulnerability by correcting how .NET Framework activates COM objects., aka '.NET Framework Elevation of Privilege Vulnerability'.
2020-03-24
N/A
4.3 MEDIUM
Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where (for example) a user continues to interact with a web site that has an invalid certificate chain.