Skip to content
OpenAdvisories

Archive

24 February 2020

Vulnerabilities first published on this day (UTC), newest first.

← January 2020 2020 / February /24 March 2020 →
  1. 11
  2. 23
  3. 336
  4. 474
  5. 566
  6. 672
  7. 768
  8. 821
  9. 9 
  10. 1058
  11. 11210
  12. 12117
  13. 13123
  14. 1434
  15. 151
  16. 167
  17. 1763
  18. 1854
  19. 1962
  20. 2053
  21. 2126
  22. 2211
  23. 236
  24. 2450
  25. 2540
  26. 2633
  27. 2778
  28. 2839
  29. 29 
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.9
    CVE-2020-5245 Public exploit

    Remote Code Execution (RCE) vulnerability in dropwizard-validation

    Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Th…

    dropwizard dropwizard-validation io.dropwizard:dropwizard-validation Maven
  • High —
    GHSA-9r27-994c-4xch

    discord-html not escaping HTML code blocks when lacking a language identifier

    ### Impact Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed. ### Patches This has been patched in version 2.3.1 ### Workarounds Escape the characters `<>&…

    discord-markdown npm
  • High 8.0
    CVE-2020-5244

    Private data exposure via REST API in BuddyPress

    In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

    BuddyPress BuddyPress buddypress/buddypress Packagist
  • High 7.5
    CVE-2012-0785

    Hash collision attack vulnerability in Jenkins

    Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash Do…

    Jenkins Project Jenkins Jenkins Enterprise by CloudBees Jenkins LTS Web / CMS Maven
  • High 7.5
    CVE-2020-8131

    Path Traversal in Yarn

    Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

    node-yarnpkg yarn Debian npm
  • High 8.8
    CVE-2020-5187

    DNN Path Traversal via Zip Slip

    DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).

    DotNetNuke.Core NuGet
  • High 8.0
    CVE-2019-3670

    Remote Code Execution vulnerability

    Remote Code Execution vulnerability in the web interface in McAfee Web Advisor (WA) 8.0.34745 and earlier allows remote unauthenticated attacker to execute arbitrary code via a cross site scripting attack.

    McAfee Web Advisor (WA)