Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdrag…
-
Unscored —
Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon…
-
Unscored —
Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can le…
-
Unscored —
Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon C…
-
Unscored —
Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto, Snapdr…
-
Unscored —
NULL is assigned to local instance of audio device pointer after free instead of global static pointer and can lead to …
-
Unscored —
Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, …
-
Unscored —
Buffer over-read can occur while playing the video clip which is not standard in Snapdragon Auto, Snapdragon Compute, S…
-
Unscored —
While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be contr…
-
Unscored —
Improper initialization of local variables which are parameters to sfs api may cause invalid pointer dereference and le…
-
Unscored —
Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdrago…
-
Unscored —
While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occ…
-
Medium 5.1
An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigg…
-
Unscored —
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a ch…
-
Unscored —
The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .p…
-
Unscored —
SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a succes…
-
Medium 6.5
There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and…
-
Medium 5.4
There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.…
-
Medium 6.5
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set…
-
Unscored —
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins direct…
-
Unscored —
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by na…
-
Unscored —
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by na…
-
Unscored —
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by na…
-
Unscored —
The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content…
-
Unscored —
Meinberg Lantime M300 and M1000 devices allow attackers (with privileges to configure a device) to execute arbitrary OS…
-
Unscored —
rust_sodium is unmaintained; switch to a modern alternative
The `rust_sodium` crate is no longer maintained by its current owner, who advise in the repository readme that they are looking for someone else to take ownership of it. We recommend you switch to an alternative crate such as: - [`sodiumoxide`](https://crates…
-
Unscored —
An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 befo…
-
Unscored —
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exi…
-
Unscored —CVE-2020-7237 EPSS 37%
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug …
-
Unscored —
Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wir…
-
Unscored —
UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cB3?ta= (profile title).
-
Unscored —
UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section).
-
Unscored —
Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is…
-
Unscored —
Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information (such as usernames and pass…
-
Unscored —
KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOOR_NAME variable in the BC_Lo…
-
Unscored —
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remo…
-
Unscored —
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products whi…
-
Unscored —
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consum…
-
Unscored —
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and pe…
-
Unscored —
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of Ro…