Archive
14 February 2020
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Critical 9.8
Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.
-
Unscored —
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines vi…
-
Critical 9.8
Code Injection in script-manager
An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
-
Unscored —
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merg…
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library o…
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGe…
-
Unscored —
HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to ge…
-
Unscored —
iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to…
-
Unscored —
In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build t…
-
Unscored —
Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via…
-
Unscored —
A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, w…
-
Unscored —
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key]…
-
Unscored —
An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specificall…
-
Unscored —
In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately…
-
Unscored —
In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities h…
-
Unscored —
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be acc…
-
Medium 4.8
An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 P…
-
Medium 5.7
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions pri…
-
Medium 5.0
Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Deskt…
-
High 7.5
An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 th…
-
Medium 6.1
A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior c…
-
Medium 5.4
An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) bas…
-
Unscored —
HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2.
-
Unscored —
The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and pr…
-
Unscored —
The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and pr…
-
Medium 4.3
A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow auth…
-
Medium 5.0
A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi I…
-
Medium 5.9
Improper Certificate Validation in Heartland & Global Payments PHP SDK
Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations.
-
Medium 5.0
ESConfig Tool able to edit configuration for newer version
Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.
-
Unscored —
ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker …
-
Unscored —
vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demon…
-
Unscored —
ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a d…
-
Unscored —CVE-2016-2338 Public exploit
An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emit…
-
Medium 5.1
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match special…