Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
High 7.5
Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a con…
-
Unscored —
Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution
-
Critical 9.8
Privilege Escalation in cordova-plugin-inappbrowser
A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
-
Unscored —
ClickDesk version 4.3 and below has persistent cross site scripting
-
Unscored —
The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip fu…
-
Unscored —
Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create …
-
Unscored —
An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other …
-
Unscored —
An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Conn…
-
Unscored —
An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS.
-
Unscored —
A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of …
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Den…
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Cont…
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorr…
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorr…
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncon…
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorre…
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorr…
-
Unscored —
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorre…
-
Unscored —
An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it wa…
-
Unscored —CVE-2012-4750 Public exploit
A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0, w…
-
Unscored —
A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Prote…
-
Unscored —
A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which…
-
Critical 9.8
HashBrown CMS RCE
A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password.
-
Unscored —
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can…
-
Unscored —
An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972 directory, …
-
Unscored —
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.
-
Unscored —
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.
-
High 7.5
Improper Verification of Cryptographic Signature in PySAML2
PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in diffe…
-
Unscored —
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persist…
-
Unscored —
An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-…
-
Unscored —
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persist…
-
Unscored —
Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attack…
-
Unscored —CVE-2019-20210 Scanner template
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflect…
-
Unscored —
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure…
-
Unscored —
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugi…
-
Unscored —
In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avas…
-
Unscored —
XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.…
-
Unscored —CVE-2019-19547 Public exploit
Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) iss…
-
Unscored —
Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation
-
Unscored —
Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets