Archive
21 January 2020
Vulnerabilities first published on this day (UTC), newest first.
76 results · Feed
-
Unscored —
There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation…
-
Unscored —
There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation…
-
High 7.5
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
-
Unscored —
repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose leng…
-
High 7.5
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
-
Unscored —
Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability.…
-
Unscored —
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in la…
-
Unscored —
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitr…
-
High 8.2
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…
KEV May 23, 2022 -
Unscored —
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks th…
-
High 7.5
Grin Insufficient Validation
Grin through 2.1.1 has Insufficient Validation.
-
Unscored —
The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. A…
-
Unscored —CVE-2019-17357 EPSS 34%
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identif…
-
Unscored —
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with …
-
Unscored —
Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
-
Unscored —
An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Fo…
-
Unscored —
The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle …
-
Unscored —
HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulne…
-
Unscored —CVE-2019-19411 Scanner template
USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100,…
-
Unscored —
apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /…
-
Unscored —
log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a…
-
Critical 9.8
papercrop does not properly handle crop input
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
-
Unscored —
The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (c…
-
Unscored —CVE-2020-6857 Public exploit
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local F…
-
Unscored —
Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-dat…
-
Unscored —
An issue was discovered in Simplejobscript.com SJS before 1.65. There is unauthenticated SQL injection via the search e…
-
Unscored —
tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
-
Medium 5.4
A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests includ…
-
Unscored —
An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated u…
-
Unscored —
In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (docume…
-
Unscored —
Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse th…
-
Unscored —
Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticate…
-
Unscored —CVE-2012-5190 Public exploit
Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability
-
Unscored —
mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.
-
Unscored —
websitebaker prior to and including 2.8.1 has an authentication error in backup module.
-
Unscored —
-
Unscored —
-
Unscored —
Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.
-
Unscored —
Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header
-
Unscored —
Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login w…