Archive
9 January 2020
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
High 7.5
Server-Side Request Forgery (SSRF) in Apache Olingo
Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect …
-
Unscored —
A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.…
-
Unscored —
An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability cau…
-
Unscored —
A potential security vulnerability has been identified with certain HP InkJet printers. The vulnerability could be expl…
-
Critical 9.6
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable mai…
-
Unscored —
There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL…
-
Unscored —
HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerabili…
-
Medium 5.4
IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted…
-
Unscored —
HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. …
-
Unscored —
Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerabi…
-
Unscored —
Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileg…
-
Unscored —
An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network att…
-
Unscored —
XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inje…
-
Unscored —
netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary …
-
Medium 6.1
An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kerne…
-
Unscored —
AgileBits 1Password through 1.0.9.340 allows security feature bypass
-
Unscored —
BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
-
Unscored —
BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
-
Unscored —
BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
-
High 7.5
Publify vulnerable to DoS attack
Publify before 8.0.1 is vulnerable to a Denial of Service attack
-
Unscored —
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web ba…
-
Unscored —
Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the W…
-
High 7.5
Ansible unsafe evaluation of some strings
Ansible prior to 1.5.4 mishandles the evaluation of some strings.
-
Unscored —
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode…
-
Unscored —
Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker…
-
Medium 6.5
Session fixation attack in Pow (Hex package)
In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, d…
-
Unscored —
In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAcc…
-
Unscored —
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.
-
Unscored —
Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.
-
Unscored —
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_isom_get_media_da…
-
Unscored —
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_m2ts_stream_proce…
-
Unscored —
jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.
-
Unscored —
jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.
-
Unscored —
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor dispu…