Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
184 results · Clear filters · Feed
-
Unscored —CVE-2013-6785 Public exploit
Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attacke…
-
Unscored —CVE-2012-5698 Public exploit
BabyGekko before 1.2.4 has SQL injection.
-
Unscored —CVE-2012-5699 Public exploit
BabyGekko before 1.2.4 allows PHP file inclusion.
-
Critical 9.8
Insecure Deserialization in Apache XML-RPC
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-R…
-
Unscored —CVE-2019-19842 Public exploit
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST req…
-
Unscored —CVE-2019-6146 Public exploit
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host head…
-
High 8.2
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…
KEV May 23, 2022 -
Unscored —CVE-2020-6857 Public exploit
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local F…
-
Unscored —CVE-2012-5190 Public exploit
Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability
-
Unscored —
-
Unscored —
-
Unscored —
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code…
-
Unscored —
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop…
-
Unscored —CVE-2020-6862 Public exploit
V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could l…
-
Unscored —CVE-2019-14615 Public exploit
Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may …
-
Unscored —CVE-2019-19142 Public exploit
Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmw…
-
High 8.0
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where th…
-
Unscored —CVE-2019-15742 Public exploit
A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client applicatio…
-
Critical 9.1
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any…
-
Medium 6.1CVE-2019-17573 Public exploit
Reflected Cross-Site Scripting in Apache CXF
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…
-
Unscored —CVE-2020-7108 Public exploit
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
-
Unscored —CVE-2009-5068 Public exploit
There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some conf…
-
Medium 4.8CVE-2020-2655 Public exploit
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppo…
KEV Nov 16, 2023 -
Critical 9.8
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). S…
KEV Nov 3, 2021 -
Critical 9.8CVE-2020-2546 Public exploit
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - Jav…
-
Unscored —CVE-2005-4891 Public exploit
Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers …
-
Unscored —CVE-2015-5466 Public exploit
Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1…
-
Medium 6.1
Reflected XSS vulnerability in Jenkins gitlab-hook Plugin
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
-
Unscored —
Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary…
-
Unscored —CVE-2015-7556 Public exploit
DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program.
-
Unscored —
Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php.
-
Unscored —CVE-2012-1563 Public exploit
Joomla! before 2.5.3 allows Admin Account Creation.
-
Medium 6.5CVE-2020-1611 Public exploit
Junos Space: Malicious HTTP packets sent to Junos Space allow an attacker to view all files on the device.
A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1.
-
Critical 9.8
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.…
KEV Nov 3, 2021 -
Unscored —CVE-2020-0624 Public exploit
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
-
High 8.1
Certificate validation bypass on Windows in crypto/x509
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …
KEV Nov 3, 2021 -
High 7.0CVE-2019-16784 Public exploit
Local Privilege Escalation present only on the Windows version of PyInstaller
In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the current one) which ha…