Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Critical 9.0
Bitdefender BOX 2 bootstrap get_image_size command injection vulnerability
A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.
-
Medium 5.4CVE-2020-7934 Public exploit
Liferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortlet
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be …
-
Unscored —
An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> S…
-
Unscored —
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certifica…
-
Unscored —
An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerabil…
-
Unscored —
ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.
-
Unscored —
An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and ma…
-
Unscored —
An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashbo…
-
Unscored —
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise …
-
Unscored —
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise …
-
Unscored —
An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash…
-
Unscored —
An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that …
-
Unscored —
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
-
Unscored —
An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (E…
-
Unscored —
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Ed…
-
Unscored —
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approva…
-
Unscored —
An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which co…
-
Unscored —
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise …
-
Unscored —
A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which cou…
-
Unscored —
Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Ed…
-
Unscored —
A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once owne…
-
Unscored —
A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
-
Medium 5.4
Cross-Site Scripting in node-red
A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.
-
Unscored —
An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Sched…
-
Medium 6.5
Information disclosure in Apache Superset
An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoin…
-
Medium 6.1
Cross-site scripting in Apache NiFi
A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.
-
Medium 5.3
Apache NiFi Insertion of Sensitive Information into Log File
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
-
Medium 6.1
Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)
All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error hand…
-
Unscored —CVE-2019-10779 Public exploit
All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cros…
-
Unscored —
Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially…
-
Unscored —
Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure…
-
Medium 4.8
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API document…
-
Medium 6.1
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a…
-
Medium 4.8
An issue was discovered in WSO2 API Manager 2.6.0. A potential stored Cross-Site Scripting (XSS) vulnerability has been…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Medium 4.8
An issue was discovered in WSO2 API Manager 2.6.0. A potential Stored Cross-Site Scripting (XSS) vulnerability has been…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and …
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and …