Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Unscored —
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed T…
-
Unscored —
DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/em…
-
Unscored —
On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) ena…
-
Unscored —
DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading…
-
Unscored —
DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.
-
Unscored —
OX App Suite through 7.10.2 has Incorrect Access Control.
-
Medium 6.1
Multiple Content Injection Vulnerabilities in marked
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.
-
Unscored —
OX App Suite through 7.10.2 has XSS.
-
Unscored —
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a…
-
Unscored —
An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. …
-
Unscored —CVE-2020-5512 EPSS 19%
Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.
-
Medium 6.5
Buffer overflow vulnerability in uftpd
In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correc…
-
Unscored —CVE-2020-5513 EPSS 26%
Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.
-
Unscored —CVE-2020-5514 EPSS 44%
Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= U…
-
Unscored —CVE-2015-4039 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authen…
-
Unscored —
Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.
-
Unscored —
An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP …
-
Unscored —
In export_key_der of export_key.cpp, there is possible memory corruption due to a double free. This could lead to local…
-
Unscored —
In km_compute_shared_hmac of km4.c, there is a possible out of bounds write due to improper input validation. This coul…
-
Unscored —
In dma_sblk_start of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. This could lead…
-
Unscored —
In set_outbound_iatu of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. This could l…
-
Unscored —
In DCRYPTO_equals of compare.c, there is a possible timing attack due to improperly used crypto. This could lead to loc…
-
High 7.5
HashBrown CMS Directory Traversal
An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field.
-
High —
Cross-Site Scripting in fileview
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
-
High —
Cross-Site Scripting in seeftl
The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.
-
Unscored —
The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to exec…
-
Unscored —
The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration…
-
Unscored —
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Serve…
-
Critical 9.8
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. …
-
High 7.2
Cisco Data Center Network Manager Command Injection Vulnerabilities
Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operati…
-
High 7.2
Cisco Data Center Network Manager Command Injection Vulnerabilities
Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operati…
-
High 7.2CVE-2019-15980 EPSS 50%
Cisco Data Center Network Manager Path Traversal Vulnerabilities
Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploi…
-
High 7.2CVE-2019-15981 EPSS 14%
Cisco Data Center Network Manager Path Traversal Vulnerabilities
Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploi…
-
High 7.2CVE-2019-15982 EPSS 14%
Cisco Data Center Network Manager Path Traversal Vulnerabilities
Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploi…
-
Medium 4.9
Cisco Data Center Network Manager XML External Entity Read Access Vulnerability
A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administra…
-
High 7.2
Cisco Data Center Network Manager SQL Injection Vulnerabilities
Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would …
-
High 7.2
Cisco Data Center Network Manager SQL Injection Vulnerabilities
Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would …
-
Medium 5.4CVE-2019-15999 Public exploit
Cisco Data Center Network Manager JBoss EAP Unauthorized Access Vulnerability
A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized access to the JBoss Enterprise Application Platform (JBoss EAP) on an affected device. The vulnerabil…
-
Critical 9.8
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. …
-
Critical 9.8
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. …