Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.
-
Unscored —
In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a u…
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier.
-
Unscored —
A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.
-
Unscored —
Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be us…
-
Unscored —
Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially …
-
Medium 5.3
Client Denial of Service on TUF
TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
-
Unscored —
MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client…
-
Unscored —CVE-2020-5509 Public exploit
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile im…
-
Unscored —CVE-2020-5505 EPSS 44%
Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunctio…
-
Unscored —
The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buff…
-
Unscored —
Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of …
-
Unscored —
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly h…
-
Medium 4.3
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) do…
-
Low 2.7
Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6…
-
Medium 5.9
Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21…
-
Medium 5.4
SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to …
-
Medium 6.1
PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode …
-
Unscored —
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdat…
-
Unscored —
abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary file…
-
Unscored —
daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-u…
-
Unscored —
The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demon…
-
Unscored —
The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a…
-
Unscored —
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a d…
-
Unscored —
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other r…
-
Medium 4.8
XSS in Apache Airflow
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
-
Unscored —
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during …
-
Unscored —
In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6…
-
Unscored —
BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
-
Unscored —
cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R…
-
Unscored —
Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). Th…
-
Unscored —
XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 al…
-
Unscored —
Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple insta…
-
Unscored —
Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10…
-
Unscored —
Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before…
-
Unscored —
Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause m…
-
Unscored —
The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arb…
-
Unscored —
On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications…
-
Unscored —CVE-2013-7185 Public exploit
PotPlayer 1.5.40688: .avi File Memory Corruption