{"vulnerability": "CVE-2020-2616", "sightings": [{"uuid": "43478122-08f2-435a-b4c8-19985640af79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26165", "type": "seen", "source": "https://t.me/cibsecurity/21485", "content": "\u203c CVE-2020-26165 \u203c\n\nqdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T00:31:55.000000Z"}, {"uuid": "8161ae85-5630-4855-a5ad-4466a352c3be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26162", "type": "seen", "source": "https://t.me/cibsecurity/15172", "content": "\u203c CVE-2020-26162 \u203c\n\nXerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-09T12:33:12.000000Z"}, {"uuid": "668df993-b50d-4584-a8ed-8a3316c0feab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26166", "type": "seen", "source": "https://t.me/cibsecurity/15047", "content": "\u203c CVE-2020-26166 \u203c\n\nThe file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-05T16:27:28.000000Z"}, {"uuid": "a8f573b5-8277-4f54-994f-97d28ad836cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26161", "type": "seen", "source": "https://t.me/cibsecurity/15589", "content": "\u203c CVE-2020-26161 \u203c\n\nIn Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-26T21:29:10.000000Z"}, {"uuid": "ef181a57-f816-41ab-823a-cb5380860b78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26168", "type": "seen", "source": "https://t.me/cibsecurity/16059", "content": "\u203c CVE-2020-26168 \u203c\n\nThe LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-10T00:55:49.000000Z"}]}