Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability
-
Unscored —CVE-2014-5381 Public exploit
Grand MA 300 allows a brute-force attack on the PIN.
-
Unscored —CVE-2014-5380 Public exploit
Grand MA 300 allows retrieval of the access PIN from sniffed data.
-
Unscored —
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed versi…
-
Unscored —
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerabil…
-
Unscored —
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
-
Unscored —
libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header mes…
-
Unscored —
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack…
-
Unscored —
Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI.
-
High 7.6
OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a m…
-
Unscored —
TopList before 2019-09-03 allows XSS via a title.
-
Unscored —
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
-
Unscored —
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
-
Unscored —
In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c.
-
Unscored —
In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.
-
Unscored —
In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c.
-
Critical 9.8
Command Injection in hot-formula-parser
grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is ta…
-
Unscored —
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-…
-
Unscored —
Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap c…
-
Unscored —CVE-2019-13767 EPSS 16%
Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the…
-
Unscored —
An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking.
-
Unscored —
Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow …
-
Unscored —
A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which c…
-
Unscored —
A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the s…
-
Critical 9.0
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, …
-
Unscored —
An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011.
-
Unscored —
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
-
Unscored —
On Ricoh SP C250DN 1.06 devices, a debug port can be used.
-
Unscored —
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).
-
Unscored —
Ricoh SP C250DN 1.06 devices allow CSRF.
-
Unscored —CVE-2019-18194 Public exploit
TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory juncti…
-
Unscored —
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote…
-
Unscored —
In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.
-
Unscored —
Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
-
Unscored —
Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attack…
-
Unscored —
An issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is triggered due to an uniniti…
-
Medium 5.3
IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used …
-
Medium 5.1
IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local …
-
Low 3.5
Possible to send drafted messages as wrong agent
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: …
-
Low 2.0
Improper handling of uploaded inline images
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edi…