Archive
27 January 2020
Vulnerabilities first published on this day (UTC), newest first.
111 results · Feed
-
Unscored —
WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
-
High 8.3
Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU…
-
Unscored —
libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the enco…
-
Unscored —
OSSIM before 4.3.3.1 has tele_compress.php path traversal vulnerability
-
Medium 5.2
Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.
-
Unscored —
AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.
-
High 8.1
SQL injection in ui-server/app/models/diary_entry.rb in SUSE Studio onsite
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and mo…
-
Low 3.7
Insecure handling of repodata and packages in SUSE Studio onlite
A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Stu…
-
Unscored —
The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-mid…
-
Unscored —
The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-…
-
Unscored —
The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man…
-
Unscored —
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers …
-
Medium 4.0
yast2-rmt exposes CA private key passhrase in log-file
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 ya…
-
Medium 4.3
obs-service-extract_file's outfilename parameter allows to write files outside of package directory
Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. Th…
-
Unscored —
In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, wit…
-
Unscored —
In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in …
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validatio…
-
Unscored —
In the Lustre file system before 2.12.3, mdt_object_remote in the mdt module has a NULL pointer dereference and panic d…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of val…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of val…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code ex…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of valid…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm_bufco…
-
Unscored —
In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due t…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an osd_map_remote_to_local out-of-bounds access and pani…
-
Unscored —
In the Lustre file system before 2.12.3, the mdt module has an out-of-bounds access and panic due to the lack of valida…
-
Unscored —
Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.
-
Unscored —
The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.
-
Unscored —
The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.
-
Unscored —
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of ser…
-
Unscored —
A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of se…