Skip to content
OpenAdvisories

Archive

2 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /2 February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

53 results · Feed

  • Medium 5.7
    CVE-2019-14864

    Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible

    Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would disclos…

    Red Hat Ansible ansible ansible Debian Alpine PyPI
  • High 7.1
    CVE-2019-14863

    AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

    There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

    Red Hat angular: angular.js angular.js Debian Ubuntu npm
  • Medium 6.1
    CVE-2019-14862

    XSS in knockout

    There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

    Red Hat knockout knockout node-knockout Debian npm
  • High 7.4
    CVE-2019-14859

    Improper Verification of Cryptographic Signature in Pure-Python ECDSA

    A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verificatio…

    Red Hat python-ecdsa ecdsa python-ecdsa Debian Ubuntu Alpine PyPI
  • Unscored —
    CVE-2019-20219

    ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c.

  • Unscored —
    CVE-2019-20225

    MyBB before 1.8.22 allows an open redirect on login.

  • Unscored —
    CVE-2019-20220

    In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected …

  • Unscored —
    CVE-2019-20221

    In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload …

  • Unscored —
    CVE-2019-20222

    In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page …

  • Unscored —
    CVE-2019-20223

    In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, …

  • Unscored —
    CVE-2019-20218

    selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

    sqlite3 sqlite3 Debian Ubuntu
  • Unscored —
    CVE-2019-20213

    D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a …

  • Critical 9.8
    CVE-2016-1000027 Public exploit EPSS 33%

    Pivotal Spring Framework contains unsafe Java deserialization methods

    Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authenticatio…

    libspring-java org.springframework:spring-web Debian Maven