Archive
2 January 2020
Vulnerabilities first published on this day (UTC), newest first.
53 results · Feed
-
Unscored —
OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.
-
Unscored —
An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was co…
-
Unscored —
FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbi…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitra…
-
Unscored —
Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web sc…
-
Unscored —
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. T…
-
Unscored —
It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary …
-
Unscored —
Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a…
-
Unscored —
Heap-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a …
-
Unscored —
Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, w…
-
Unscored —
SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated u…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote au…
-
Unscored —
Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the syst…
-
Unscored —
Heap-based buffer overflow in xnview.exe in XnView before 2.13 allows remote attackers to execute arbitrary code via th…
-
Unscored —
xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allow…
-
Unscored —
Xjp2.dll in XnView before 2.13 allows remote attackers to execute arbitrary code via (1) the Csiz parameter in a SIZ ma…
-
Unscored —
In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the s…
-
Unscored —CVE-2013-3944 EPSS 28%
Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execut…
-
Unscored —
The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband ta…
-
Unscored —
Heap-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute…
-
Unscored —
obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.
-
Unscored —
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attacke…
-
Medium 6.1
Plone Zope cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecif…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.…
-
Unscored —
Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generat…
-
Unscored —CVE-2013-3619 Public exploit
Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_…
-
Medium 5.9
ovirt-engine-sdk-python improper validation of hostname in x.509 certificate
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers…
-
Unscored —
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potent…
-
Medium 6.0
A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform databas…
-
Unscored —
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then execute…
-
Medium 6.1
Symfony Host Header Injection vulnerability in the HttpFoundation component
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker c…
-
Unscored —
Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on…
-
Medium —
Denial of Service in ecstatic
ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remo…
-
Medium 5.4
Improper implementation of the session fixation protection in Infinispan
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.