Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.
-
Unscored —CVE-2019-15707 Public exploit
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow adm…
-
High 7.5
Improper Resource Shutdown or Release in HashiCorp Vault
HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.
-
Unscored —
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow adm…
-
Unscored —
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security…
-
Unscored —
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enume…
-
Unscored —
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows rem…
-
Unscored —
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misco…
-
Unscored —
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS i…
-
Unscored —
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to s…
-
Unscored —
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS pla…
-
Unscored —
A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow atta…
-
High 7.5
Undertow vulnerable to Uncontrolled Resource Consumption
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
-
High 7.7
Local privilege escalation from user munge to root
A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge …
-
Unscored —
Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.
-
Medium 6.2
apt-cacher-ng insecure use of /run/apt-cacher-ng
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng …
-
Unscored —
mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
-
Unscored —
Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate pr…
-
Unscored —
Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking
-
Unscored —CVE-2013-6792 Public exploit
Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability
-
Unscored —
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
-
Unscored —CVE-2020-7931 Public exploit
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modi…
-
Unscored —
Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability
-
Unscored —
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and the…
-
Medium 6.1
Cross-Site Scripting in sanitize-html
sanitize-html before 1.4.3 has XSS.
-
Unscored —CVE-2013-4175 Public exploit
MySecureShell 1.31 has a Local Denial of Service Vulnerability
-
Unscored —CVE-2013-6785 Public exploit
Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attacke…
-
Unscored —
mysecureshell 1.31: Local Information Disclosure Vulnerability
-
Unscored —CVE-2012-5698 Public exploit
BabyGekko before 1.2.4 has SQL injection.
-
Unscored —CVE-2012-5699 Public exploit
BabyGekko before 1.2.4 allows PHP file inclusion.
-
Unscored —
-
High 7.7
trousers: Local privilege escalation from tss to root
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 tr…
-
Unscored —
Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference
-
Unscored —
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
-
Unscored —
-
Unscored —
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST req…
-
Unscored —CVE-2019-19838 EPSS 24%
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST req…
-
Unscored —
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83…
-
Unscored —
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of ser…
-
Unscored —
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote inform…