Archive
6 January 2020
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Mod…
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Mod…
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Mod…
-
Unscored —
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity …
-
Unscored —
A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -w…
-
Unscored —CVE-2014-8674 Public exploit
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the do…
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freeb…
-
Unscored —
A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
-
Unscored —
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to…
-
Unscored —
OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control.…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H…
-
Unscored —
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/ob…
-
Unscored —
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed T…
-
Unscored —
DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/em…
-
Unscored —
On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) ena…
-
Unscored —
DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading…
-
Unscored —
DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.
-
Unscored —
OX App Suite through 7.10.2 has Incorrect Access Control.
-
Medium 6.1
Multiple Content Injection Vulnerabilities in marked
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.
-
Unscored —
OX App Suite through 7.10.2 has XSS.
-
Unscored —
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a…
-
Unscored —
An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. …
-
Unscored —CVE-2020-5512 EPSS 19%
Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.
-
Medium 6.5
Buffer overflow vulnerability in uftpd
In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correc…
-
Unscored —CVE-2020-5513 EPSS 26%
Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.
-
Unscored —CVE-2020-5514 EPSS 44%
Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= U…
-
Unscored —CVE-2015-4039 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authen…
-
Unscored —
Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.
-
Unscored —
An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP …
-
Unscored —
In export_key_der of export_key.cpp, there is possible memory corruption due to a double free. This could lead to local…
-
Unscored —
In km_compute_shared_hmac of km4.c, there is a possible out of bounds write due to improper input validation. This coul…
-
Unscored —
In dma_sblk_start of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. This could lead…
-
Unscored —
In set_outbound_iatu of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. This could l…
-
Unscored —
In DCRYPTO_equals of compare.c, there is a possible timing attack due to improperly used crypto. This could lead to loc…
-
High 7.5
HashBrown CMS Directory Traversal
An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field.
-
High —
Cross-Site Scripting in fileview
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
-
High —
Cross-Site Scripting in seeftl
The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.
-
Unscored —
The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to exec…
-
Unscored —
The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration…
-
Unscored —
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Serve…