CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none.
A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.
A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.
Aircam_firmware, Aircam, Unifi_video_controller, Er-x_firmware, Er-x, Er-x-sfp_firmware, Er-x-sfp, Ep-r6_firmware, Ep-r6, Erlite-3_firmware
2020-12-04
N/A
8.8 HIGH
A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands.
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.