Archive
29 January 2020
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
High 8.6
Cisco Small Business Switches Denial of Service Vulnerability
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web inte…
-
Unscored —
Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hi…
-
Unscored —
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially cr…
-
Unscored —CVE-2013-3320 Public exploit
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to injec…
-
Unscored —
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.
-
Unscored —
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for…
-
Critical 9.8
OS Command Injection in lsof
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
-
Critical 9.1
HTTP Request Smuggling in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
-
Medium —CVE-2019-20445 EPSS 14%
HTTP Request Smuggling in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
-
Medium 6.1
Magento stored cross-site scripting vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
-
High 7.5
Magento sql injection vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
-
Critical 9.8
Magento security bypass vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Medium 5.3
Magento Path Traversal
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.
-
Critical 9.8CVE-2020-3716 EPSS 14%
Magento deserialization vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Medium 6.1
Magento stored cross-site scripting vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /l…
-
Unscored —
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double fre…
-
Unscored —
A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Ca…
-
Unscored —
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 …
-
Unscored —
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to …
-
Unscored —
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the…
-
Unscored —
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation i…
-
Unscored —
A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is di…
-
Unscored —
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireles…
-
Unscored —
An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcode…
-
Unscored —
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to t…
-
Medium 5.3
Code Injection into Bitdefender AV for Mac
A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable to cause third-party code execution
-
Low 1.6
Privilege escalation in Bitdefender AV for Mac
A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted to the Bitdefender Cloud. This issue affects: Bitdefender Bitdefender Antivirus for Mac v…
-
Critical 9.8
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…
KEV Mar 25, 2022 -
Unscored —
Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.…
-
Unscored —
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to …
-
Unscored —
Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by …
-
Medium 4.3
Fortify Plugin stored credentials in plain text
Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
High 7.6
XXE vulnerability in Jenkins WebSphere Deployer Plugin
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.
-
Medium 5.4
Stored XSS vulnerability in Code Coverage API Plugin
Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.