Skip to content
OpenAdvisories

Archive

27 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /27 February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.3
    CVE-2019-11288

    tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation

    In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the…

    Pivotal Pivotal tc Server 4.x Pivotal tc Server 4.x Runtimes Pivotal tc Server 3.x
  • High 8.1
    CVE-2019-17095

    Bitdefender BOX 2 bootstrap download_image command injection vulnerability

    A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers, leading to arbit…

    Bitdefender Bitdefender BOX 2
  • High 8.3
    CVE-2019-17094

    Stack-Based Overflow vulnerability in Belkin WeMo Insights Switch

    A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code execution on the device. This issue affects: Belkin WeMo Insight Switch firmware version 2.00.11396 and pri…

    Belkin Belkin WeMo Insight Switch
  • High 7.5
    CVE-2020-7238

    HTTP Request Smuggling in Netty

    Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

    netty netty io.netty:netty-handler netty-3.9 Debian Ubuntu Maven
  • High 8.3
    CVE-2019-17102

    Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)

    An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU…

    Bitdefender Bitdefender BOX 2
  • High 8.1
    CVE-2017-14807

    SQL injection in ui-server/app/models/diary_entry.rb in SUSE Studio onsite

    An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and mo…

    SUSE Studio onsite