Skip to content
OpenAdvisories

Archive

January 2020

Vulnerabilities first published in this month (UTC), newest first.

← December 2019 2020 / January February 2020 →
  1. 15
  2. 253
  3. 353
  4. 44
  5. 515
  6. 663
  7. 734
  8. 8103
  9. 974
  10. 1040
  11. 118
  12. 12 
  13. 1343
  14. 14107
  15. 15278
  16. 1631
  17. 1734
  18. 181
  19. 196
  20. 2010
  21. 2176
  22. 2254
  23. 2378
  24. 2466
  25. 2512
  26. 2631
  27. 27111
  28. 28110
  29. 2954
  30. 3056
  31. 3151
All Critical High Medium Low Exploited only Public exploit

1,661 results · Feed

  • Low 3.5
    CVE-2020-1765

    Spoofing of From field in several screens

    An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and …

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Unscored —
    CVE-2014-5093 Public exploit

    Status2k does not remove the install directory allowing credential reset.

  • Unscored —
    CVE-2014-5092 Public exploit

    Status2k allows Remote Command Execution in admin/options/editpl.php.

  • Medium 5.4
    CVE-2013-6430

    Improper Neutralization of Input During Web Page Generation in Spring Framework

    The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line…

    Pivotal Spring MVC libspring-java org.springframework:spring-web Debian Maven
  • Unscored —
    CVE-2011-4595 Public exploit

    Pretty-Link WordPress plugin 1.5.2 has XSS

    pretty-link pretty-link plugin Web / CMS
  • Unscored —
    CVE-2013-7380

    The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability

  • Unscored —
    CVE-2013-6231 Public exploit

    SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

  • Unscored —
    CVE-2014-4561 Scanner template

    The ultimate-weather plugin 1.0 for WordPress has XSS

  • Unscored —
    CVE-2014-4530

    flog plugin 0.1 for WordPress has XSS

  • Unscored —
    CVE-2014-4982

    LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.

  • Unscored —
    CVE-2014-5081 Public exploit EPSS 10%

    sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass

  • Unscored —
    CVE-2014-4984

    Déjà Vu Crescendo Sales CRM has remote SQL Injection

  • Medium 6.5
    CVE-2014-5011

    DOMPDF Information Disclosure

    DOMPDF before 0.6.2 allows Information Disclosure.

    dompdf/dompdf php-dompdf php-dompdf Debian Ubuntu Packagist
  • Medium 6.5
    CVE-2014-5012

    DOMPDF denial of service vulnerability

    DOMPDF before 0.6.2 allows denial of service.

    dompdf/dompdf php-dompdf php-dompdf Debian Ubuntu Packagist
  • High 8.8
    CVE-2014-5013

    DOMPDF Remote Code Execution

    DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.

    dompdf/dompdf php-dompdf php-dompdf Debian Ubuntu Packagist
  • Unscored —
    CVE-2019-20375

    A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitra…

  • Unscored —
    CVE-2019-20376

    A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitra…

  • High 8.3
    CVE-2019-20374

    A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to …

  • Unscored —
    CVE-2019-20373

    LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the…

    ldm Ubuntu
  • Critical 9.8
    CVE-2020-6756 Public exploit EPSS 11%

    languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to r…

  • Medium 5.4
    CVE-2020-6758

    A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KD…

  • High 7.4
    CVE-2020-6757

    contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers …

  • High 8.8
    CVE-2020-5504 Public exploit EPSS 28%

    phpMyAdmin SQL injection in user accounts page

    In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access …

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist
  • Unscored —
    CVE-2012-3810 Public exploit

    Samsung Kies before 2.5.0.12094_27_11 has registry modification.

  • Unscored —
    CVE-2012-3809 Public exploit

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.

  • Unscored —
    CVE-2012-3808 Public exploit

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.

  • Unscored —
    CVE-2012-3807 Public exploit EPSS 32%

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.

  • Unscored —
    CVE-2012-3806

    Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attack…

  • Unscored —
    CVE-2019-20178

    Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.

  • Unscored —
    CVE-2019-20179

    SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.

  • Unscored —
    CVE-2019-20183 Scanner template

    uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension…

  • Unscored —
    CVE-2019-20181

    The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.

  • Unscored —
    CVE-2019-20184

    KeePass 2.4.1 allows CSV injection in the title field of a CSV export.

    keepass2 keepass2 Debian Ubuntu
  • Unscored —
    CVE-2012-2950

    Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote at…

  • Unscored —
    CVE-2019-20182

    The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.

  • Unscored —
    CVE-2012-2931

    PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arb…

  • Unscored —
    CVE-2010-3282

    389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, wh…

    Red Hat HP HP-UX Directory Server 389 Directory Server
  • Unscored —
    CVE-2012-2142

    The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF…

    Poppler poppler poppler Debian
  • Unscored —
    CVE-2012-5558

    Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-…

    Smiley;Smileys Smileys Smiley
  • Unscored —
    CVE-2012-4434

    fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute ar…

    fwknop fwknop fwknop Debian