Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (…
-
Unscored —CVE-2014-5287 Public exploit
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input …
-
Unscored —
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.
-
Unscored —
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.
-
Unscored —
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.
-
Medium —
XSS in Ignite Realtime Openfire via isTrustStore
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
-
Unscored —
An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200…
-
Critical 9.8
OS command injection in aws-lambda
In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.Func…
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the ITMS workflow process manager console in Symantec IT Managemen…
-
Unscored —
CA Automic Dollar Universe 5.3.3 contains a vulnerability, related to the uxdqmsrv binary being setuid root, that allow…
-
Unscored —
CA Automic Sysload 5.6.0 through 6.1.2 contains a vulnerability, related to a lack of authentication on the File Server…
-
Unscored —
An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. Deserialization of untrusted data when parsing JSON in…
-
Unscored —
A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Su…
-
High 7.5
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially …
-
Unscored —
A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite…
-
Unscored —CVE-2014-2072 Public exploit
Dassault Systemes Catia V5-6R2013: Stack Buffer Overflow due to inadequate boundary checks
-
Unscored —
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
-
Unscored —CVE-2020-0009 Public exploit
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. Thi…
-
Unscored —
MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due…
-
Unscored —
A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enab…
-
Critical 9.8
OS Command Injection in devcert-sanscache
devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.
-
Unscored —
A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.…
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
-
Unscored —
A Denial of Service vulnerability exists in Google Android 4.4.4, 5.0.2, and 5.1.1, which allows malicious users to blo…
-
Unscored —
In Teradici PCoIP Agent before 19.08.1 and PCoIP Client before 19.08.3, an unquoted service path can cause execution of…
-
Unscored —
centurystar 7.12 ActiveX Control has a Stack Buffer Overflow
-
Unscored —
Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user in…
-
Unscored —CVE-2020-6170 Public exploit
An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain c…
-
High 8.3
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to …
-
High 7.5
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and…
-
High —
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
### Impact We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE. This vulnerability impacts - phpunit before 4…
-
High —
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
### Impact We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE. This vulnerability impacts - phpunit before 4.…
-
Unscored —
The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySu…
-
Unscored —
An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control m…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Paralle…
-
Medium 4.3
This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent …
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N rou…
-
Unscored —
A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker t…
-
Unscored —
An issue was discovered in OpServices OpMon 9.3.1-1. Using password change parameters, an attacker could perform SQL in…