Look up vulnerabilities by software, product or CVE number.
| CVE | Published | CVSS | ShadowTrackr CVSS | Summary |
|---|---|---|---|---|
CVE: CVE-2020-2509 | Published 2021-04-17 | CVSS: 9.8 | ShadowTrackr CVSS: 9.2 | Summary: A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later |
CVE: CVE-2020-25097 | Published 2021-03-19 | CVSS: 8.6 | ShadowTrackr CVSS: 6.9 | Summary: An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings. |
CVE: CVE-2020-25094 | Published 2020-12-17 | CVSS: 9.8 | ShadowTrackr CVSS: 7.2 | Summary: LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges. |
CVE: CVE-2020-25095 | Published 2020-12-17 | CVSS: 8.8 | ShadowTrackr CVSS: 4.8 | Summary: LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user. This can include WebSocket payloads that result in command execution. |
CVE: CVE-2020-25096 | Published 2020-12-17 | CVSS: 8.8 | ShadowTrackr CVSS: 5.2 | Summary: LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application server, which will forward requests to any configured back-end server, regardless of whether the user's access rights should permit this. As a result, even the most low-privileged user can interact with any back-end component that has a LogRhythm agent installed. |
CVE: CVE-2020-25090 | Published 2020-09-03 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php. |
CVE: CVE-2020-25091 | Published 2020-09-03 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php. |
CVE: CVE-2020-25092 | Published 2020-09-03 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/greenlabel, and application/views/templates/redlabel. |
CVE: CVE-2020-25093 | Published 2020-09-03 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel. |