Data on 1.4 Million Washington State Residents Breached

Enterprise VulnerabilitiesFrom DHS/US-CERT's National Vulnerability Database CVE-2020-28493PUBLISHED: 2021-02-01

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and lim...

CVE-2020-20290PUBLISHED: 2021-02-01

Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability.

CVE-2020-20294PUBLISHED: 2021-02-01

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands.

CVE-2020-20295PUBLISHED: 2021-02-01

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands.

CVE-2020-20296PUBLISHED: 2021-02-01

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands.

Support the originator by clicking the read the rest link below.