Archive
8 January 2020
Vulnerabilities first published on this day (UTC), newest first.
103 results · Feed
-
Unscored —
An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. Deserialization of untrusted data when parsing JSON in…
-
Unscored —
A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Su…
-
High 7.5
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially …
-
Unscored —
A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite…
-
Unscored —CVE-2014-2072 Public exploit
Dassault Systemes Catia V5-6R2013: Stack Buffer Overflow due to inadequate boundary checks
-
Unscored —
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
-
Unscored —CVE-2020-0009 Public exploit
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. Thi…
-
Unscored —
MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due…
-
Unscored —
A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enab…
-
Critical 9.8
OS Command Injection in devcert-sanscache
devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.
-
Unscored —
A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.…
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
-
Unscored —
A Denial of Service vulnerability exists in Google Android 4.4.4, 5.0.2, and 5.1.1, which allows malicious users to blo…
-
Unscored —
In Teradici PCoIP Agent before 19.08.1 and PCoIP Client before 19.08.3, an unquoted service path can cause execution of…
-
Unscored —
centurystar 7.12 ActiveX Control has a Stack Buffer Overflow
-
Unscored —
Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user in…
-
Unscored —CVE-2020-6170 Public exploit
An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain c…
-
High 8.3
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to …
-
High 7.5
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and…
-
High —
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
### Impact We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE. This vulnerability impacts - phpunit before 4…
-
High —
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
### Impact We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE. This vulnerability impacts - phpunit before 4.…
-
Unscored —
The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySu…
-
Unscored —
An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control m…