Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release…
-
High 8.1
A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue…
-
Unscored —CVE-2020-5842 Public exploit
Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI.…
-
Unscored —
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Ja…
-
Unscored —
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parame…
-
Unscored —
Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspeci…
-
Critical 9.8
OS command injection in git-diff-apply
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
-
Unscored —
An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthen…
-
Unscored —
An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may al…
-
Unscored —CVE-2019-9465 Public exploit
In the Titan M handling of cryptographic operations, there is a possible information disclosure due to an unusual root …
-
Unscored —
Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php i…
-
High —
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
### Impact We have identified that some ps_facetedsearch module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE. This vulnerability impacts - phpunit befo…
-
High 7.5
A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc …
-
Medium 6.7
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is u…
-
Unscored —
AultWare pwStore 2010.8.30.0 has XSS
-
Unscored —CVE-2013-5657 Public exploit
AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request
-
Medium 5.3
OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given o…
-
Unscored —CVE-2013-5656 Public exploit
FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability
-
High 7.5
A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. Th…
-
Critical 9.1
keycloak vulnerable to unauthorized login via mail server setup
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be …
-
Unscored —
Transcend WiFiSD 1.8 has persistent XSS
-
Low 3.7
A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a deni…
-
Unscored —
PQI AirCard has persistent XSS
-
Medium 4.2
Moodle does not revoke role capabilities correctly
A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).
-
Unscored —
In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS.
-
Unscored —
Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthen…
-
Unscored —
HMailServer 5.3.x and prior: Memory Corruption which could cause DOS
-
Unscored —
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Mod…
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Mod…
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Mod…
-
Unscored —
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity …
-
Unscored —
A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -w…
-
Unscored —CVE-2014-8674 Public exploit
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the do…
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freeb…
-
Unscored —
A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
-
Unscored —
A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to…
-
Unscored —
OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control.…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H…
-
Unscored —
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/ob…