Archive
10 January 2020
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
Unscored —
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-…
-
Unscored —
Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap c…
-
Unscored —CVE-2019-13767 EPSS 16%
Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the…
-
Unscored —
An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking.
-
Unscored —
Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow …
-
Unscored —
A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which c…
-
Unscored —
A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the s…
-
Critical 9.0
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, …
-
Unscored —
An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011.
-
Unscored —
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
-
Unscored —
On Ricoh SP C250DN 1.06 devices, a debug port can be used.
-
Unscored —
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).
-
Unscored —
Ricoh SP C250DN 1.06 devices allow CSRF.
-
Unscored —CVE-2019-18194 Public exploit
TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory juncti…
-
Unscored —
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote…
-
Unscored —
In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.
-
Unscored —
Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
-
Unscored —
Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attack…
-
Unscored —
An issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is triggered due to an uniniti…
-
Medium 5.3
IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used …
-
Medium 5.1
IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local …
-
Low 3.5
Possible to send drafted messages as wrong agent
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: …
-
Low 2.0
Improper handling of uploaded inline images
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edi…
-
Low 3.5
Spoofing of From field in several screens
An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and …
-
Unscored —CVE-2014-5093 Public exploit
Status2k does not remove the install directory allowing credential reset.
-
Unscored —CVE-2014-5092 Public exploit
Status2k allows Remote Command Execution in admin/options/editpl.php.
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Spring Framework
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line…
-
Unscored —CVE-2011-4595 Public exploit
Pretty-Link WordPress plugin 1.5.2 has XSS
-
Unscored —
The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
-
Unscored —CVE-2013-6231 Public exploit
SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script
-
Unscored —CVE-2014-4561 Scanner template
The ultimate-weather plugin 1.0 for WordPress has XSS
-
Unscored —
flog plugin 0.1 for WordPress has XSS
-
Unscored —
LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
-
Unscored —
sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
-
Unscored —
Déjà Vu Crescendo Sales CRM has remote SQL Injection
-
Medium 6.5
DOMPDF Information Disclosure
DOMPDF before 0.6.2 allows Information Disclosure.
-
Medium 6.5
DOMPDF denial of service vulnerability
DOMPDF before 0.6.2 allows denial of service.
-
High 8.8
DOMPDF Remote Code Execution
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
-
Unscored —
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitra…
-
Unscored —
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitra…