Skip to content
OpenAdvisories

Archive

30 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /30 February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.7
    CVE-2020-5232

    Ethereum Name Service - Malicious takeover of previously owned ENS names

    A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consent or awareness. A new ENS deployment is being rolled out that fixes this vulnerability in the ENS re…

    ensdomains @ensdomains/ens @ensdomains/ens npm
  • High 8.7
    CVE-2020-5206

    Authentication Bypass For Endpoints With Anonymous Access in OpenCast

    In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. …

    opencast opencast org.opencastproject:opencast-kernel Maven
  • High 7.5
    CVE-2020-8494

    In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser s…

  • High 7.5
    CVE-2020-8495 Public exploit

    In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate s…

  • High 7.7
    CVE-2020-5230

    Opencast uses unsafe identifiers

    Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker b…

    opencast opencast org.opencastproject:base Maven
  • High 7.5
    CVE-2015-8851

    Insecure Entropy Source - Math.random() in node-uuid

    node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.

    node-uuid node-uuid node-uuid node-uuid Debian npm
  • High 7.7
    CVE-2020-5229

    Opencast stores passwords using outdated MD5 hash algorithm

    Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to c…

    opencast opencast org.opencastproject:opencast-common-jpa-impl Maven
  • High 7.6
    CVE-2020-5228

    Opencast allows unauthorized public access via OAI-PMH

    Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to us…

    opencast opencast org.opencastproject:opencast-oaipmh-api Maven