Archive
7 February 2020
Vulnerabilities first published on this day (UTC), newest first.
68 results · Feed
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.…
-
Unscored —
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.
-
Unscored —
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's pe…
-
High 7.5
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page.…
KEV Nov 3, 2021 -
Unscored —
The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manage…
-
Unscored —
The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged u…
-
Unscored —
Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitr…
-
Unscored —
-
Unscored —
A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.
-
High 7.0
It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3…
-
Critical 10.0
Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 a…
-
High 8.6
Path Traversal in Bosch Video Management System (BVMS)
A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.…
-
Unscored —
Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the serv…
-
Critical 10.0
Missing Authentication for Critical Function in Bosch Video Streaming Gateway
Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiali…
-
Unscored —
D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability.
-
Unscored —
Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.
-
Unscored —
An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authenticati…
-
Unscored —CVE-2014-5087 Public exploit
A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could …
-
Unscored —
A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, w…
-
Unscored —
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.
-
Unscored —CVE-2014-5288 Public exploit
A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.
-
Unscored —
A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.c…
-
Unscored —
A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/…
-
Medium 5.4
External Interface does not invalidate session
The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions.
-
Unscored —
A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the ac…
-
High 7.0
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for di…
KEV Nov 3, 2021 -
Unscored —
statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.
-
Unscored —
A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impa…
-
Unscored —CVE-2019-15606 EPSS 20%
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on h…
-
Unscored —CVE-2019-15604 EPSS 20%
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 cert…
-
Unscored —
A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resu…
-
Unscored —
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
-
Unscored —
A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to ov…
-
Unscored —
ProjectPier 0.8.8 does not use the Secure flag for cookies
-
Unscored —
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
-
Unscored —
ProjectPier 0.8.8 has stored XSS
-
Unscored —
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution