Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
-
Unscored —
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
-
Unscored —
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
-
Unscored —
In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
-
Unscored —
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
-
Unscored —
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows insta…
-
Unscored —
Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.
-
Unscored —
In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.
-
Unscored —
Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated u…
-
Unscored —
Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.
-
Unscored —
Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.
-
Unscored —
Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table action
-
Unscored —
Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive.
-
Unscored —
Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password.
-
Unscored —
Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities
-
Unscored —
Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability
-
Unscored —
OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability
-
Unscored —
ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilities
-
Unscored —
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability
-
Unscored —
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a…
-
Unscored —
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a…
-
Unscored —
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a…
-
Unscored —
In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control …
-
Unscored —
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to p…
-
Unscored —
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a…
-
Unscored —
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a…
-
Medium 6.5
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…
-
High 8.6
Cisco Small Business Switches Denial of Service Vulnerability
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web inte…
-
Unscored —
Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hi…
-
Unscored —
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially cr…
-
Unscored —CVE-2013-3320 Public exploit
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to injec…
-
Unscored —
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.
-
Unscored —
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for…
-
Critical 9.8
OS Command Injection in lsof
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
-
Critical 9.1
HTTP Request Smuggling in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
-
Medium —CVE-2019-20445 EPSS 14%
HTTP Request Smuggling in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
-
Medium 6.1
Magento stored cross-site scripting vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
-
High 7.5
Magento sql injection vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
-
Critical 9.8
Magento security bypass vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Medium 5.3
Magento Path Traversal
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.