Skip to content
OpenAdvisories

Archive

23 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /23 February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.5
    CVE-2019-19894

    In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. …

  • Medium 6.1
    CVE-2020-7936

    Plone Open Redirect Vulnerability

    An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.

    plone PyPI
  • Medium 5.4
    CVE-2020-7937

    Plone cross site scripting (XSS)

    An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.

    plone PyPI
  • Medium 6.2
    CVE-2019-18899

    apt-cacher-ng insecure use of /run/apt-cacher-ng

    The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng …

    openSUSE Leap 15.1
  • Medium 6.1
    CVE-2016-1000237

    Cross-Site Scripting in sanitize-html

    sanitize-html before 1.4.3 has XSS.

    sanitize-html npm
  • Medium 4.3
    CVE-2020-7210

    Umbraco CMS vulnerable to CSRF

    Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.

    UmbracoCms.Core NuGet
  • Medium 4.4
    CVE-2020-5216

    Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

    In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leadi…

    Twitter secure_headers secure_headers ruby-secure-headers Debian Ubuntu RubyGems
  • Medium 4.4
    CVE-2020-5217

    Directive injection when using dynamic overrides with user input in RubyGems secure_headers

    In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected lea…

    Twitter secure_headers secure_headers ruby-secure-headers Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2020-5223

    Persistent XSS vulnerability in filename of attached file in PrivateBin

    In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulner…

    PrivateBin PrivateBin privatebin/privatebin Packagist
  • Medium 5.4
    CVE-2019-14885

    A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system …

    Red Hat JBoss EAP