Skip to content
OpenAdvisories

Archive

24 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /24 February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.4
    CVE-2020-5226

    Cross-site scripting in SimpleSAMLphp

    Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to hand…

    simplesamlphp simplesamlphp simplesamlphp simplesamlphp/simplesamlphp Debian Packagist
  • Medium 4.4
    CVE-2020-5225

    Log injection in SimpleSAMLphp

    Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an a…

    simplesamlphp simplesamlphp simplesamlphp simplesamlphp Debian Ubuntu Packagist
  • Medium 6.5
    CVE-2020-5224

    Session key exposure through session list in Django User Sessions

    In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the w…

    Jazzband django-user-sessions django-user-sessions PyPI
  • Medium 5.3
    CVE-2020-7964

    Missing Authentication for Critical Function in Saleor

    An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of…

    saleor PyPI
  • Medium 6.5
    CVE-2014-9720

    Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

    Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

    python-tornado tornado Debian PyPI
  • Medium 4.0
    CVE-2019-18900

    libzypp stores cookies world readable

    : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: …

    SUSE SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 12 CaaS Platform 3.0 Linux Debian Ubuntu
  • Medium 4.0
    CVE-2019-3687

    "easy" permission profile allows everyone execute dumpcap and read all network traffic

    The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f86…

    SUSE SUSE Linux Enterprise Server Linux