Archive
28 January 2020
Vulnerabilities first published on this day (UTC), newest first.
110 results · Feed
-
Unscored —
fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause …
-
Medium 4.4
Feedgen Vulnerable to XML Denial of Service Attacks
Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this proce…
-
Unscored —
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info…
-
Unscored —CVE-2020-8424 Public exploit
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.ph…
-
Unscored —CVE-2020-8425 Public exploit
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
-
Unscored —
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, D…
-
Medium 5.0
Segmentation faultin TensorFlow when converting a Python string to tf.float16
In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inferen…
-
Unscored —
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP se…
-
Unscored —
An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause…
-
Unscored —
An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
-
Unscored —
An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates caus…
-
Unscored —
An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processi…
-
Unscored —
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
-
Unscored —CVE-2013-3212 Public exploit
vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote att…
-
High 8.8
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import m…
-
Unscored —
An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.…
-
Unscored —
ASUS RT-N56U devices allow CSRF.
-
Unscored —
NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (devic…
-
Unscored —
NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass.
-
Unscored —
Secure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow remote attackers to conduct…
-
Unscored —
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 fir…
-
Unscored —
Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.
-
Unscored —CVE-2013-2714 Public exploit
Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web …
-
Unscored —
Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary …
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote …
-
Unscored —
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon laun…
-
Critical 9.8
IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by imp…
-
Medium 4.3
IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system an…
-
High 7.1
IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when proce…
-
Low 3.7
IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This coul…
-
Medium 5.9
IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decr…
-
Medium 4.3
IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass appl…
-
Low 2.7
IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error mess…
-
Low 2.7
IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporope…
-
Low 3.1
IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive COR…
-
High 8.4
IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper valida…
-
High 7.4
IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attac…
-
Medium 6.1
IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Medium 5.9
IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to caus…
-
Medium 5.3
IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of servic…