Archive
27 January 2020
Vulnerabilities first published on this day (UTC), newest first.
111 results · Feed
-
Medium 4.8
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API document…
-
Medium 6.1
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a…
-
Medium 4.8
An issue was discovered in WSO2 API Manager 2.6.0. A potential stored Cross-Site Scripting (XSS) vulnerability has been…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Medium 4.8
An issue was discovered in WSO2 API Manager 2.6.0. A potential Stored Cross-Site Scripting (XSS) vulnerability has been…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and …
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and …
-
Medium 6.1
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If the…
-
Unscored —
Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier ve…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software vers…
-
Unscored —
A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software vers…
-
Unscored —
Command-injection vulnerability in Huawei E587 3G Mobile Hotspot 11.203.27 allows remote attackers to execute arbitrary…
-
Unscored —
SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via s…
-
Medium 4.8
Typo3 Cross-Site Scripting in Flash component (ELTS)
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.
-
Unscored —
Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' paramet…
-
Unscored —CVE-2013-2267 Public exploit
PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbi…
-
Unscored —
The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a succe…
-
Unscored —CVE-2012-6448 Public exploit
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web scri…
-
Medium 4.4
Ability in Sylius to switch channels via GET parameter enabled in production environments
Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly…
-
Medium 4.4
Ability to expose data in Sylius by using an unintended serialisation group
Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone…
-
Unscored —
panel_login.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password ha…
-
Unscored —
SMC Networks D3G0804W D3GNV5M-3.5.1.6.10_GA devices allow remote command execution by leveraging access to the Network …
-
Medium 5.4
Request smuggling is possible in Ktor when both chunked TE and content length specified
In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.
-
High 7.3
tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation
In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the…
-
Unscored —
Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.
-
Unscored —
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
-
Unscored —
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
-
Unscored —
Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS.
-
Unscored —
An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library …
-
Unscored —
Zimbra Collaboration before 8.6.0 patch5 has XSS.
-
Unscored —
Synacor Zimbra Collaboration before 8.0.8 has XSS.
-
Unscored —
Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.
-
Unscored —
Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.
-
Unscored —
In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.
-
Unscored —CVE-2019-19143 Public exploit
TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cg…
-
Unscored —
An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L0…
-
Unscored —
Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the fire…