Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-…
-
Unscored —
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged…
-
Unscored —
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. T…
-
Unscored —
The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notific…
-
Unscored —
The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system acti…
-
Unscored —
The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to…
-
Unscored —
The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the…
-
Unscored —
The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive in…
-
Unscored —
The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to imprope…
-
Unscored —
The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to imprope…
-
Unscored —
The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to im…
-
Critical 9.8
ImpressPages CMS RCE
ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)
-
Unscored —
An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _b…
-
Medium 6.9
downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolver
In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.
-
Unscored —
Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.
-
Unscored —
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-f…
-
Unscored —
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-f…
-
Unscored —
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notific…
-
Unscored —
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applica…
-
Unscored —
A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a…
-
Unscored —
A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during …
-
Unscored —
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminat…
-
Unscored —
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafre…
-
Unscored —
There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation…
-
Unscored —
There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation…
-
High 7.5
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
-
Unscored —
repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose leng…
-
High 7.5
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
-
Unscored —
Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability.…
-
Unscored —
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in la…
-
Unscored —
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitr…
-
High 8.2
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…
KEV May 23, 2022 -
Unscored —
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks th…
-
High 7.5
Grin Insufficient Validation
Grin through 2.1.1 has Insufficient Validation.
-
Unscored —
The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. A…
-
Unscored —CVE-2019-17357 EPSS 34%
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identif…
-
Unscored —
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with …
-
Unscored —
Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
-
Unscored —
An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Fo…
-
Unscored —
The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle …