Skip to content
OpenAdvisories

Archive

2 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /2 February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.1
    CVE-2013-7062

    Plone Zope cross-site scripting (XSS) vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecif…

    plone PyPI
  • Medium 5.9
    CVE-2014-0161

    ovirt-engine-sdk-python improper validation of hostname in x.509 certificate

    ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers…

    ovirt-engine-sdk-python ovirt-engine-sdk-python ovirt-engine-sdk-python PyPI
  • Medium 6.0
    CVE-2019-10205

    A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform databas…

    Red Hat quay
  • Medium 6.1
    CVE-2013-4752

    Symfony Host Header Injection vulnerability in the HttpFoundation component

    Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker c…

    symfony/symfony symfony/http-foundation Packagist
  • Medium —
    CVE-2019-10775

    Denial of Service in ecstatic

    ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.

    ecstatic npm
  • Medium 5.4
    CVE-2019-10158

    Improper implementation of the session fixation protection in Infinispan

    A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

    Red Hat infinispan org.infinispan:infinispan-core Maven
  • Medium 5.7
    CVE-2019-14864

    Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible

    Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would disclos…

    Red Hat Ansible ansible ansible Debian Alpine PyPI
  • Medium 6.1
    CVE-2019-14862

    XSS in knockout

    There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

    Red Hat knockout knockout node-knockout Debian npm