Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
184 results · Clear filters · Feed
-
Unscored —
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitr…
-
Unscored —CVE-2013-4861 Public exploit
Directory traversal vulnerability in cgi-bin/cmh/get_file.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remot…
-
Unscored —CVE-2013-4862 Public exploit
MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users t…
-
Unscored —
The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute …
-
Unscored —CVE-2013-4864 Public exploit
MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the ur…
-
Unscored —CVE-2013-4865 Public exploit
Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allow…
-
Unscored —
Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary…
-
Medium 5.4CVE-2020-7934 Public exploit
Liferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortlet
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be …
-
Unscored —
An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> S…
-
Unscored —CVE-2019-10779 Public exploit
All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cros…
-
Unscored —
Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' paramet…
-
Unscored —CVE-2013-2267 Public exploit
PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbi…
-
Unscored —CVE-2012-6448 Public exploit
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web scri…
-
Unscored —CVE-2019-19143 Public exploit
TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cg…
-
Unscored —
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before bui…
-
Unscored —
Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 all…
-
Unscored —CVE-2020-7949 Public exploit
schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by…
-
Unscored —CVE-2011-4558 Public exploit
Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and r…
-
Unscored —
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_use…
-
Unscored —CVE-2012-1496 Public exploit
Local file inclusion in WebCalendar before 1.2.5.
-
Unscored —CVE-2020-7991 Public exploit
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
-
Unscored —CVE-2013-1744 Public exploit
IRIS citations management tool through 1.3 allows remote attackers to execute arbitrary commands.
-
Unscored —
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to t…
-
Unscored —CVE-2019-1351 Public exploit
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual…
-
Unscored —
A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to t…
-
Unscored —
A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET req…
-
Unscored —
An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP pa…
-
Unscored —CVE-2019-19363 Public exploit
An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attacke…
-
Unscored —
A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in th…
-
Unscored —CVE-2013-1594 Public exploit
An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wir…
-
Unscored —
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
-
Unscored —CVE-2012-6663 Public exploit
General Electric D20ME devices are not properly configured and reveal plaintext passwords.
-
Unscored —CVE-2012-5340 Public exploit
SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corr…
-
Unscored —
A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending spec…
-
Unscored —
Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.
-
Unscored —CVE-2019-15707 Public exploit
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow adm…
-
Unscored —
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enume…
-
Unscored —CVE-2013-6792 Public exploit
Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability
-
Unscored —CVE-2020-7931 Public exploit
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modi…
-
Unscored —CVE-2013-4175 Public exploit
MySecureShell 1.31 has a Local Denial of Service Vulnerability