Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
High 7.9
Broadcom brcmfmac driver is vulnerable to a frame validation bypass
The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this…
-
Critical 9.1
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any…
-
Unscored —
HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrat…
-
Unscored —
A potential security vulnerability has been identified in HPE enhanced Internet Usage Manager (eIUM) versions 8.3 and 9…
-
Unscored —
GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/…
-
Medium 6.1CVE-2019-17573 Public exploit
Reflected Cross-Site Scripting in Apache CXF
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…
-
High 7.5
Private key leak in Apache CXF
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local …
-
Unscored —
Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform…
-
High 7.1
A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (Al…
-
Unscored —
A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....…
-
Unscored —
A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation …
-
Unscored —
A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), T…
-
Unscored —
The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka C…
-
Unscored —
Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attacker…
-
Unscored —CVE-2020-7108 Public exploit
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
-
Unscored —CVE-2020-7107 Scanner template
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.
-
Unscored —
Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automati…
-
Unscored —
async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return val…
-
Unscored —
In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c…
-
Unscored —
In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c …
-
Unscored —
A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCAL…
-
Unscored —
An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Token…
-
Unscored —
An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows sto…
-
Unscored —
An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin…
-
Unscored —
An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their …
-
Unscored —
An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows …
-
Unscored —
An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The Add Collaborator allow…
-
Unscored —
Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.…
-
Unscored —
Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from ve…
-
Unscored —
Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.1…
-
Unscored —CVE-2009-5068 Public exploit
There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some conf…
-
Unscored —
A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a …
-
Medium 6.1
Cross-site scripting in markdown2 for python
python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.
-
High 7.5
Clam AntiVirus (ClamAV) Software Email Parsing Vulnerability
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to ineffici…
-
Unscored —
The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation i…
-
High 7.5
Improper Certificate Validation in Apache Beam
The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets re…
-
Unscored —
In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files whe…
-
Unscored —
OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site script…
-
Unscored —
OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request …
-
Unscored —
OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to an improper access co…