Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-…
-
Unscored —
The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man…
-
Unscored —
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers …
-
Medium 4.0
yast2-rmt exposes CA private key passhrase in log-file
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 ya…
-
Medium 4.3
obs-service-extract_file's outfilename parameter allows to write files outside of package directory
Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. Th…
-
Unscored —
In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, wit…
-
Unscored —
In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in …
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validatio…
-
Unscored —
In the Lustre file system before 2.12.3, mdt_object_remote in the mdt module has a NULL pointer dereference and panic d…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of val…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of val…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code ex…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of valid…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm_bufco…
-
Unscored —
In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due t…
-
Unscored —
In the Lustre file system before 2.12.3, the ptlrpc module has an osd_map_remote_to_local out-of-bounds access and pani…
-
Unscored —
In the Lustre file system before 2.12.3, the mdt module has an out-of-bounds access and panic due to the lack of valida…
-
Unscored —
Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.
-
Unscored —
The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.
-
Unscored —
The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.
-
Unscored —
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of ser…
-
Unscored —
A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of se…
-
Medium 6.1
Dolibarr cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs…
-
Critical 9.8
Dolibarr Improper Restriction of Excessive Authentication Attempts
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
-
Medium 6.1
XSS in Dolibarr ERP & CRM
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
-
Unscored —
Adive Framework 2.0.8 has admin/user/add userUsername XSS.
-
Unscored —
Adive Framework 2.0.8 has admin/user/add userName XSS.
-
Unscored —CVE-2020-7991 Public exploit
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
-
Unscored —
SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain a…
-
High 7.5
Cisco Webex Meetings Suite and Cisco Webex Meetings Online Unauthenticated Meeting Join Vulnerability
A vulnerability in Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow an unauthenticated, remote attendee to join a password-protected meeting without providing the meeting password. The connection attempt must initiate from a …
-
Medium 6.1
Cisco Finesse Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the software fails to sanit…
-
Medium 4.3
Cisco UCS Director Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from an affected device. The vulnerability is due to an issue in the authentication logic of the web-based…
-
High 7.2
Cisco Webex Video Mesh Node Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated, remote attacker to execute arbitrary commands on the affected system. The vulnerability is due to improper validation of user-supplied input by the w…
-
Medium 5.4
Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Scripting Vulnerability
A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of an affecte…
-
Medium 6.1
Cisco Crosswork Change Automation Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Crosswork Change Automation could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected syste…
-
Medium 6.8
Cisco Mobility Management Entity Denial of Service Vulnerability
A vulnerability in the implementation of the Stream Control Transmission Protocol (SCTP) on Cisco Mobility Management Entity (MME) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an eNodeB that is connected to a…
-
Medium 6.5
Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the so…
-
Medium 6.1
Cisco Data Center Analytics Framework Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affec…
-
Medium 6.5
Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to …
-
Medium 6.5
Cisco Webex Teams Adaptive Cards Denial of Service Vulnerability
A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerabilit…