Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificat…
-
Unscored —
Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks
-
Unscored —CVE-2012-1563 Public exploit
Joomla! before 2.5.3 allows Admin Account Creation.
-
Unscored —
Joomla! core before 2.5.3 allows unauthorized password change.
-
Unscored —
Cisco IronPort Web Security Appliance AsyncOS software prior to 7.5 has a SSL Certificate Caching vulnerability which c…
-
Unscored —
whoopsie-daisy before 0.1.26: Root user can remove arbitrary files
-
Medium 6.5CVE-2020-1611 Public exploit
Junos Space: Malicious HTTP packets sent to Junos Space allow an attacker to view all files on the device.
A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1.
-
High 8.8
Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv6 packets and arbitrarily execute commands on the target device.
When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv6 packets who may then arbitrarily execute comm…
-
High 7.5
Junos OS: MX Series: In BBE configurations, receipt of a specific MPLS or IPv6 packet causes a Denial of Service
Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for Broadband Edge (BBE) service may trigger a kernel crash (vmcore), causing the device to reboot. The issue is specific to the processing of packets des…
-
High 7.5
Junos OS: Cross-Site Scripting (XSS) in J-Web
Insufficient Cross-Site Scripting (XSS) protection in J-Web may potentially allow a remote attacker to inject web script or HTML, hijack the target user's J-Web session and perform administrative actions on the Junos device as the targeted user. This issue af…
-
High 8.8
Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv4 packets and arbitrarily execute commands on the target device.
When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may then arbitrarily execute comm…
-
Medium 5.4
Junos OS: Path traversal vulnerability in J-Web
A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and delete files with 'world' writeable permission. This issue does not affect system files that can be…
-
High 8.6
Junos OS: Improper handling of specific IPv6 packets sent by clients eventually kernel crash (vmcore) the device.
Specific IPv6 packets sent by clients processed by the Routing Engine (RE) are improperly handled. These IPv6 packets are designed to be blocked by the RE from egressing the RE. Instead, the RE allows these specific IPv6 packets to egress the RE, at which poi…
-
Medium 6.5
Junos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packets
On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. This issue only affects firewall filter evaluation of certain packets destined to the devi…
-
High 7.1
Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv4 packets may take over the code execution of the JDHCPD process.
When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may remotely take over the code e…
-
Medium 5.3
Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash.
Certain types of malformed Path Computation Element Protocol (PCEP) packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computation Client (PCC) in a PCEP environment using Juniper's path computational element protocol …
-
Medium 6.5
Junos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.
In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite loop causing a high …
-
Unscored —
data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input …
-
Medium 5.0
Missing permission checks in Jenkins Amazon EC2 Plugin
A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.
-
Medium 6.5
phpBB allows CSRF
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
-
Medium 4.3
phpBB Cross-Site Request Forgery (CSRF)
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.
-
Unscored —
A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to by…
-
Unscored —
A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a spec…
-
Unscored —CVE-2020-0653 EPSS 22%
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obj…
-
Unscored —CVE-2020-0652 EPSS 18%
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle ob…
-
Unscored —CVE-2020-0650 EPSS 18%
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obj…
-
Unscored —
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, a…
-
Unscored —CVE-2020-0651 EPSS 18%
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obj…
-
Critical 9.8
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.…
KEV Nov 3, 2021 -
Unscored —
An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka …
-
Unscored —
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
-
Unscored —
An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handle…
-
Unscored —
An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary location…
-
Unscored —
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Interne…
-
Unscored —
An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information…
-
Unscored —
An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to pro…
-
High 7.8CVE-2020-0638 Exploited · Ransomware
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this…
KEV May 23, 2022 -
Unscored —
An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbo…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Wind…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles…