Archive
14 January 2020
Vulnerabilities first published on this day (UTC), newest first.
11 results · Clear filters · Feed
-
Medium 6.5
phpBB allows CSRF
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
-
Medium 4.3
phpBB Cross-Site Request Forgery (CSRF)
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.
-
Medium —
Denial of service in ASP.NET Core
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
-
Medium 6.1
Drupal Cross-Site Scripting vulnerability
A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.
-
Medium 5.3
Kubernetes ingress exposes sensitive information
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
-
Medium 5.3
Client Denial of Service on TUF
TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
-
Medium 4.3
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) do…
-
Medium 5.9
Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21…
-
Medium 5.4
SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to …
-
Medium 6.1
PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode …
-
Medium 4.8
XSS in Apache Airflow
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.