Archive
20 February 2020
Vulnerabilities first published on this day (UTC), newest first.
53 results · Feed
-
Medium 5.7
Denial of Service in uap-core when processing crafted User-Agent strings
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overlo…
-
High 7.7
openHAB exec add-ons allow remote arbitrary command execution
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands ne…
-
Unscored —
Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product i…
-
Unscored —
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service …
-
Unscored —
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an insta…
-
Unscored —
Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.
-
Unscored —
Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.
-
Unscored —
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitatio…
-
Unscored —
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the Ethernet VPN application (org.onosproject.…
-
Unscored —
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual tenant network application (org.on…
-
Unscored —
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the access control application (org.onosprojec…
-
Unscored —
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobi…
-
Unscored —
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway applicat…
-
Unscored —
Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before…
-
Unscored —
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly ot…
-
Unscored —
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the P4 tutorial application (org.onosproject.p…
-
Unscored —
Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) …
-
Unscored —
Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an administrative user to perform a SQL injection attack by configuri…
-
Unscored —
Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification…
-
Unscored —
A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Speci…
-
Critical 9.8
Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation coul…
-
Unscored —
Adobe Media Encoder versions 14.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could …
-
Unscored —CVE-2012-3351 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attacker…
-
Unscored —
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficien…
-
Unscored —
Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause …
-
Unscored —
fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access …
-
High 7.6
IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is v…
-
Medium 4.3
IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from…
-
High 7.5
Moped Rubygem Data Injection Vulnerability
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted stri…
-
High 7.5
BSON rubygem contains potential denial of service
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015…
-
Unscored —
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path…
-
Unscored —
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipu…
-
Unscored —CVE-2014-7951 Public exploit
Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate at…
-
Unscored —
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a …
-
Unscored —
ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function.
-
Medium 5.5
Ansible sets unsafe permissions for sources.list
Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.
-
Medium 5.5
Ansible Sensitive Files Are Locally Readable
The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.
-
Critical 9.8
Ansible Remote Code Execution
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
-
Unscored —
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to caus…
-
Unscored —CVE-2012-5362 EPSS 15%
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a f…