10 February 2020

58 results · Feed

• Unscored —
  CVE-2014-5084 Public exploit

  A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let…

  Feb 10, 2020
• Unscored —
  CVE-2014-5085 Public exploit

  A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, wh…

  Feb 10, 2020
• Medium 6.1
  CVE-2020-1697

  XSS in Keycloak

  It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other r…

  Red Hat keycloak org.keycloak:keycloak-core Maven
  Feb 10, 2020
• Unscored —
  CVE-2014-5086 Public exploit

  A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrit…

  Feb 10, 2020
• Unscored —
  CVE-2013-1353

  Orange HRM 2.7.1 allows XSS via the vacancy name.

  Feb 10, 2020
• Unscored —
  CVE-2012-6666

  vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.

  Feb 10, 2020
• Unscored —
  CVE-2019-20060

  MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third…

  Feb 10, 2020
• Unscored —
  CVE-2019-20061

  The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this …

  Feb 10, 2020
• Unscored —
  CVE-2019-20062

  MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash …

  Feb 10, 2020
• Unscored —
  CVE-2019-20059 Public exploit

  payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values…

  Feb 10, 2020
• Unscored —
  RUSTSEC-2020-0158

  slice-deque is unmaintained

  The author of the `slice-deque` crate is unresponsive and is not receiving security patches. Maintained alternatives: - [`slice-ring-buffer`](https://crates.io/crates/slice-ring-buffer)

  slice-deque crates.io
  Feb 10, 2020
• Unscored —
  RUSTSEC-2020-0144

  lzw is unmaintained

  The author of the `lzw` crate is unresponsive. Maintained alternatives: - [`weezl`](https://crates.io/crates/weezl)

  lzw crates.io
  Feb 10, 2020
• Unscored —
  CVE-2020-8825 Public exploit

  index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.

  Feb 10, 2020
• Medium 6.5
  CVE-2020-7060

  global buffer-overflow in mbfl_filt_conv_big5_wchar

  When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buff…

  PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  Feb 10, 2020
• Medium 6.5
  CVE-2020-7059

  OOB read in php_strip_tags_ex

  When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to informa…

  PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  Feb 10, 2020
• Medium 6.1
  CVE-2020-8823

  Cross-site scripting in SocksJS-node

  htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.

  sockjs npm
  Feb 10, 2020
• Unscored —
  CVE-2020-8822

  Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.

  Feb 10, 2020
• Unscored —
  CVE-2017-18641

  In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running…

  lxc lxc lxc-templates lxc-templates Debian Ubuntu
  Feb 10, 2020