Skip to content
OpenAdvisories

Archive

24 February 2020

Vulnerabilities first published on this day (UTC), newest first.

← January 2020 2020 / February /24 March 2020 →
  1. 11
  2. 23
  3. 336
  4. 474
  5. 566
  6. 672
  7. 768
  8. 821
  9. 9 
  10. 1058
  11. 11210
  12. 12117
  13. 13123
  14. 1434
  15. 151
  16. 167
  17. 1763
  18. 1854
  19. 1962
  20. 2053
  21. 2126
  22. 2211
  23. 236
  24. 2450
  25. 2540
  26. 2633
  27. 2778
  28. 2839
  29. 29 
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 4.8
    CVE-2020-1935

    Potential HTTP request smuggling in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • Medium 4.8
    CVE-2019-17569

    Potential HTTP request smuggling in Apache Tomcat

    The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Reque…

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Maven
  • Medium 6.5
    CVE-2020-1937 Public exploit

    SQL Injection in Kylin

    Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

    Apache Apache Kylin org.apache.kylin:kylin-server-base Maven
  • Medium 5.3
    CVE-2019-10798

    Uncontrolled Resource Consumption in rdf-graph-array

    rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.

    rdf-graph-array npm
  • Medium 4.3
    CVE-2019-4745

    IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated…

    IBM Maximo Asset Management
  • Medium 5.3
    CVE-2019-4703

    IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attack…

    IBM Spectrum Protect Plus
  • Medium 6.8
    CVE-2019-4595

    IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing …

    IBM Sterling B2B Integrator
  • Medium 6.4
    CVE-2020-8130

    OS Command Injection in Rake

    There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.

    rake rake rake Debian Ubuntu RubyGems
  • Medium 4.6
    CVE-2019-20480

    In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a maliciou…

  • Medium 4.6
    CVE-2019-20481

    In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old passw…

  • Medium 5.4
    CVE-2020-5186

    DNN XSS Vulnerability

    DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).

    DotNetNuke.Core NuGet
  • Medium 6.5
    CVE-2020-5188

    DNN File Upload Vulnerability

    DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.

    DotNetNuke.Core NuGet