Archive
14 January 2020
Vulnerabilities first published on this day (UTC), newest first.
107 results · Feed
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdat…
-
Unscored —
abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary file…
-
Unscored —
daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-u…
-
Unscored —
The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demon…
-
Unscored —
The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a…
-
Unscored —
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a d…
-
Unscored —
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other r…
-
Medium 4.8
XSS in Apache Airflow
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
-
Unscored —
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during …
-
Unscored —
In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6…
-
Unscored —
BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
-
Unscored —
cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R…
-
Unscored —
Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). Th…
-
Unscored —
XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 al…
-
Unscored —
Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple insta…
-
Unscored —
Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10…
-
Unscored —
Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before…
-
Unscored —
Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause m…
-
Unscored —
The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arb…
-
Unscored —
On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications…
-
Unscored —CVE-2013-7185 Public exploit
PotPlayer 1.5.40688: .avi File Memory Corruption
-
High 7.5
Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a con…
-
Unscored —
Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution
-
Critical 9.8
Privilege Escalation in cordova-plugin-inappbrowser
A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
-
Unscored —
ClickDesk version 4.3 and below has persistent cross site scripting
-
Unscored —
The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip fu…
-
Unscored —
Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create …