Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —CVE-2020-0624 Public exploit
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects…
-
Unscored —
An elevation of privilege vulnerability exists when Microsoft Cryptographic Services improperly handles files, aka 'Mic…
-
Unscored —
A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password upda…
-
Unscored —
A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate…
-
Unscored —
An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to pro…
-
Unscored —
A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of S…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, ak…
-
Unscored —
A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious s…
-
Unscored —
A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to th…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
-
Unscored —
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'W…
-
High 8.8CVE-2020-0606 EPSS 18%
Remote code execution in Microsoft.WindowsDesktop.App.Ref
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framewor…
-
Unscored —
An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, …
-
Unscored —CVE-2020-0605 EPSS 18%
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a f…
-
High —CVE-2020-0603 EPSS 23%
Remote code execution in ASP.NET Core
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core R…
-
High 8.1
Certificate validation bypass on Windows in crypto/x509
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …
KEV Nov 3, 2021 -
Medium —
Denial of service in ASP.NET Core
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
-
Unscored —
Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessi…
-
Critical 9.8
Drupal SQL Injection vulnerability
An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
-
Medium 6.1
Drupal Cross-Site Scripting vulnerability
A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.
-
Unscored —
A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a special…
-
Unscored —
MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer o…
-
Unscored —
An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a fail…
-
Unscored —
A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earli…
-
Medium 5.3
Kubernetes ingress exposes sensitive information
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
-
High 7.0CVE-2019-16784 Public exploit
Local Privilege Escalation present only on the Windows version of PyInstaller
In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the current one) which ha…