Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Critical 9.8CVE-2020-3716 EPSS 14%
Magento deserialization vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Medium 6.1
Magento stored cross-site scripting vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could le…
-
Unscored —
An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /l…
-
Unscored —
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double fre…
-
Unscored —
A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Ca…
-
Unscored —
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 …
-
Unscored —
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to …
-
Unscored —
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the…
-
Unscored —
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation i…
-
Unscored —
A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is di…
-
Unscored —
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireles…
-
Unscored —
An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcode…
-
Unscored —
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to t…
-
Medium 5.3
Code Injection into Bitdefender AV for Mac
A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable to cause third-party code execution
-
Low 1.6
Privilege escalation in Bitdefender AV for Mac
A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted to the Bitdefender Cloud. This issue affects: Bitdefender Bitdefender Antivirus for Mac v…
-
Critical 9.8
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…
KEV Mar 25, 2022 -
Unscored —
Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.…
-
Unscored —
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to …
-
Unscored —
Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by …
-
Medium 4.3
Fortify Plugin stored credentials in plain text
Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
High 7.6
XXE vulnerability in Jenkins WebSphere Deployer Plugin
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.
-
Medium 5.4
Stored XSS vulnerability in Code Coverage API Plugin
Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.
-
Low 3.1
Jenkins REST APIs vulnerable to clickjacking
REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.
-
Medium 5.4CVE-2020-2103 Scanner template
Jenkins Diagnostic page exposed session cookies
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
-
Medium 4.3
Memory usage graphs accessible to anyone with Overall/Read
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.
-
Medium 5.8
Jenkins vulnerable to UDP amplification reflection attack
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.
-
Medium 5.3
Non-constant time HMAC comparison
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
-
Medium 5.3
Non-constant time comparison of inbound TCP agent connection secret
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
-
High 8.6
Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be u…
-
Unscored —
-
Unscored —
Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.
-
High 8.8
Contao core SQL Injection Vulnerability
contao prior to 2.11.4 has a sql injection vulnerability
-
High 8.8
Cross-Site Request Forgery in Webargs
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allo…
-
Unscored —
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to …
-
Unscored —
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to …