Archive
19 February 2020
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Medium 6.7
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privi…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a bu…
-
Medium 6.5
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated att…
-
Medium 6.5
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a…
-
High 7.5
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauth…
-
Medium 4.4
IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the o…
-
Medium 4.3
IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obt…
-
Medium 5.4
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
High 7.5
Nokogiri is vulnerable to XML External Entity (XXE) attack
Nokogiri before 1.5.4 is vulnerable to XXE attacks
-
Unscored —
A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web…
-
Unscored —
D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the Busy…
-
Unscored —
The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
-
Unscored —
The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe des…
-
Unscored —
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might …
-
Unscored —
HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applica…
-
Unscored —
mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if o…
-
Unscored —
Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_…
-
Critical 9.8
Deserialization of Untrusted Data in PyYAML
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
-
Unscored —
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with a…
-
Medium 4.3
Cisco ASA Secondary Authentication Bypass Vulnerability
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. …
-
Medium 4.3
Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters pass…
-
Low 3.3
OpenStack Nova can leak consoleauth token into log files
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups u…