Archive
14 January 2020
Vulnerabilities first published on this day (UTC), newest first.
107 results · Feed
-
Unscored —
A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious s…
-
Unscored —
A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to th…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
-
Unscored —
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'W…
-
High 8.8CVE-2020-0606 EPSS 18%
Remote code execution in Microsoft.WindowsDesktop.App.Ref
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framewor…
-
Unscored —
An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, …
-
Unscored —CVE-2020-0605 EPSS 18%
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a f…
-
High —CVE-2020-0603 EPSS 23%
Remote code execution in ASP.NET Core
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core R…
-
High 8.1
Certificate validation bypass on Windows in crypto/x509
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …
KEV Nov 3, 2021 -
Medium —
Denial of service in ASP.NET Core
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
-
Unscored —
Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessi…
-
Critical 9.8
Drupal SQL Injection vulnerability
An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
-
Medium 6.1
Drupal Cross-Site Scripting vulnerability
A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.
-
Unscored —
A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a special…
-
Unscored —
MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer o…
-
Unscored —
An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a fail…
-
Unscored —
A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earli…
-
Medium 5.3
Kubernetes ingress exposes sensitive information
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
-
High 7.0CVE-2019-16784 Public exploit
Local Privilege Escalation present only on the Windows version of PyInstaller
In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the current one) which ha…
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.
-
Unscored —
In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a u…
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier.
-
Unscored —
A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.
-
Unscored —
Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be us…
-
Unscored —
Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially …
-
Medium 5.3
Client Denial of Service on TUF
TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
-
Unscored —
MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client…
-
Unscored —CVE-2020-5509 Public exploit
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile im…
-
Unscored —CVE-2020-5505 EPSS 44%
Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunctio…
-
Unscored —
The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buff…
-
Unscored —
Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of …
-
Unscored —
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly h…
-
Medium 4.3
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) do…
-
Low 2.7
Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6…
-
Medium 5.9
Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21…
-
Medium 5.4
SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to …
-
Medium 6.1
PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode …
-
Unscored —
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write…