Skip to content
OpenAdvisories

Archive

15 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /15 February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

278 results · Feed

  • Unscored —
    CVE-2019-19854

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Token…

  • Unscored —
    CVE-2019-19855

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows sto…

  • Unscored —
    CVE-2019-19856

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin…

  • Unscored —
    CVE-2019-19857

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their …

  • Unscored —
    CVE-2019-19858

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows …

  • Unscored —
    CVE-2019-19859

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The Add Collaborator allow…

  • Unscored —
    CVE-2019-15010

    Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.…

    Atlassian Bitbucket Server Bitbucket Data Center
  • Unscored —
    CVE-2019-15012

    Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from ve…

    Atlassian Bitbucket Server Bitbucket Data Center
  • Unscored —
    CVE-2019-20097

    Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.1…

    Atlassian Bitbucket Server Bitbucket Data Center
  • Unscored —
    CVE-2009-5068 Public exploit

    There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some conf…

    SMF SMF
  • Unscored —
    CVE-2009-5025

    A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a …

    PyForum PyForum
  • Medium 6.1
    CVE-2009-3724

    Cross-site scripting in markdown2 for python

    python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.

    python-markdown2 python-markdown2 markdown2 PyPI
  • High 7.5
    CVE-2019-15961

    Clam AntiVirus (ClamAV) Software Email Parsing Vulnerability

    A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to ineffici…

    clamav clamav clamav clamav Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-3941

    The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation i…

    VMware VMware Tools for Windows (VMware Tools) Windows
  • High 7.5
    CVE-2020-1929

    Improper Certificate Validation in Apache Beam

    The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets re…

    Apache Beam org.apache.beam:beam-sdks-java-io-mongodb Maven
  • Unscored —
    CVE-2019-18244

    In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files whe…

  • Unscored —
    CVE-2019-18273

    OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site script…

  • Unscored —
    CVE-2019-18271

    OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request …

  • Unscored —
    CVE-2019-18275

    OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to an improper access co…

  • Unscored —
    CVE-2015-6591

    Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and e…

  • High 7.5
    CVE-2015-1811

    XML external entity (XXE) vulnerability in Jenkins

    XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.

    CloudBees Jenkins LTS Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • High 7.5
    CVE-2015-1809

    XML external entity (XXE) vulnerability in Jenkins

    XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.

    CloudBees Jenkins Jenkins LTS org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Unscored —
    CVE-2014-6448

    Juniper Junos OS 13.2 before 13.2R5, 13.2X51, 13.2X52, and 13.3 before 13.3R3 allow local users to bypass intended rest…

  • Unscored —
    CVE-2009-1120

    EMC RepliStor Server Service before ESA-09-003 has a DoASOCommand Remote Code Execution Vulnerability. The flaw exists …

    EMC RepliStor
  • Unscored —
    CVE-2015-5071

    AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote aut…

  • Unscored —
    CVE-2015-5072

    The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remot…

  • Medium 5.3
    CVE-2019-9510

    Microsoft Windows RDP can bypass the Windows lock screen

    A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user sessions without needing to interact with the Windows lock screen. Should a network anomaly trigger a t…

    Microsoft Windows Server Windows 10 or newer system using RDP Windows
  • Medium 6.5
    CVE-2019-9493

    MyCar Controls uses hard-coded credentials

    The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able to send commands to and retrieve data from a target MyCar unit. This may allow the attacker to learn …

    AutoMobility Distribution MyCar Controls
  • Medium 5.3
    CVE-2017-3211

    Centire Yopify leaks customer information

    Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without user authorization.

    Centire Yopify
  • High 8.8
    CVE-2015-6497

    Magento arbitrary PHP code execution via the productData parameter

    The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute ar…

    magento/core Packagist
  • Unscored —
    CVE-2007-4774

    The Linux kernel before 2.4.36-rc1 has a race condition. It was possible to bypass systrace policies by flooding the pt…

    linux-azure linux linux-aws linux-lts-xenial Ubuntu
  • Medium 5.4
    CVE-2020-2729

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Advanced Console). Supported vers…

    Oracle Identity Manager
  • Low 3.9
    CVE-2020-2731

    Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2,…

    Oracle Oracle Database
  • Medium 5.4
    CVE-2020-2730

    Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Appl…

    Oracle Financial Services Revenue Management and Billing
  • Medium 6.5
    CVE-2020-2725

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…

    Oracle VM VirtualBox virtualbox Virtualization Ubuntu
  • High 7.5
    CVE-2020-2726

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…

    Oracle VM VirtualBox virtualbox Virtualization Ubuntu
  • Medium 6.0
    CVE-2020-2727

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…

    Oracle VM VirtualBox virtualbox Virtualization Ubuntu
  • High 7.5
    CVE-2020-2728

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM - LDAP user and role Synch). …

    Oracle Identity Manager
  • Medium 5.4
    CVE-2020-2720

    Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: I…

    Oracle FLEXCUBE Investor Servicing
  • Medium 6.5
    CVE-2020-2711

    Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Suppo…

    Oracle Banking Payments