Skip to content
OpenAdvisories

Archive

January 2020

Vulnerabilities first published in this month (UTC), newest first.

← December 2019 2020 / January February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

184 results · Clear filters · Feed

  • Unscored —
    CVE-2020-8512 Public exploit EPSS 15%

    In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.

  • Unscored —
    CVE-2020-8504 Public exploit

    School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrat…

  • Unscored —
    CVE-2020-8505 Public exploit

    School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.

  • Unscored —
    CVE-2014-8322 Public exploit EPSS 24%

    Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote atta…

    aircrack-ng Debian
  • Unscored —
    CVE-2014-3868 Public exploit

    Multiple SQL injection vulnerabilities in ZeusCart 4.x.

  • Unscored —
    CVE-2014-3119 Public exploit

    Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbit…

  • Unscored —
    CVE-2019-13000 Public exploit

    Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md state…

  • High 7.5
    CVE-2019-12999 Public exploit

    Improper Access Control in Lightning Network Daemon

    Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.

    github.com/lightningnetwork/lnd Go
  • Unscored —
    CVE-2019-19550 Public exploit

    Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of …

  • Medium 6.9
    CVE-2020-8493 Public exploit

    A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 vi…

  • High 7.5
    CVE-2020-8495 Public exploit

    In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate s…

  • Unscored —
    CVE-2013-2294 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arb…

  • Unscored —
    CVE-2013-4241 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow re…

    HitMyServer HMS Testimonials
  • Unscored —
    CVE-2013-0291 Public exploit EPSS 16%

    NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability

    NextGEN Gallery Plugin authors NextGEN Gallery Plugin Web / CMS
  • Unscored —
    CVE-2013-3320 Public exploit

    Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to injec…

  • Unscored —
    CVE-2013-2574 Public exploit EPSS 30%

    An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /l…

  • Unscored —
    CVE-2013-2573 Public exploit EPSS 42%

    A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Ca…

  • Unscored —
    CVE-2013-2572 Public exploit EPSS 16%

    A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 …

  • Unscored —
    CVE-2013-2570 Public exploit EPSS 27%

    A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to …

  • Unscored —
    CVE-2019-18634 Public exploit EPSS 19%

    In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the…

    sudo sudo sudo Debian Ubuntu Alpine
  • Unscored —
    CVE-2013-3215 Public exploit EPSS 69%

    vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation i…

  • Unscored —
    CVE-2013-2569 Public exploit EPSS 31%

    A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is di…

  • Unscored —
    CVE-2013-2568 Public exploit EPSS 49%

    A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireles…

  • Unscored —
    CVE-2013-2567 Public exploit EPSS 15%

    An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcode…

  • Unscored —
    CVE-2020-8416 Public exploit EPSS 14%

    IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to t…

  • Critical 9.8
    CVE-2020-7247 Exploited Public exploit EPSS 99%

    smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…

    opensmtpd opensmtpd opensmtpd Debian Ubuntu Alpine
    KEV Mar 25, 2022
  • Unscored —
    CVE-2013-0161 Public exploit

    Havalite CMS 1.1.7 has a stored XSS vulnerability

    Havalite CMS
  • Unscored —
    CVE-2019-20215 Public exploit EPSS 75%

    D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to th…

  • Unscored —
    CVE-2020-8424 Public exploit

    Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.ph…

  • Unscored —
    CVE-2020-8425 Public exploit

    Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.

  • Unscored —
    CVE-2013-1603 Public exploit EPSS 16%

    An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, D…

  • Unscored —
    CVE-2013-1602 Public exploit EPSS 15%

    An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP se…

  • Unscored —
    CVE-2013-1601 Public exploit EPSS 12%

    An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processi…

  • Unscored —
    CVE-2013-3214 Public exploit EPSS 85%

    vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.

  • Unscored —
    CVE-2013-3212 Public exploit

    vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote att…

  • High 8.8
    CVE-2020-8417 Public exploit EPSS 12%

    The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import m…

  • Unscored —
    CVE-2013-1600 Public exploit EPSS 19%

    An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.…

  • Unscored —
    CVE-2013-1599 Public exploit EPSS 40%

    A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 fir…

  • Unscored —
    CVE-2013-2748 Public exploit EPSS 13%

    Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.

  • Unscored —
    CVE-2013-2714 Public exploit

    Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web …