Archive
25 February 2020
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
Unscored —
Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local,…
-
Unscored —
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows S…
-
Unscored —
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x b…
-
Unscored —
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
-
Unscored —CVE-2020-8809 Public exploit
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connec…
-
Unscored —
An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify…
-
Unscored —
The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496…
-
Unscored —CVE-2019-3999 Public exploit
Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, …
-
High 8.8
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.
-
High 7.2
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
-
Unscored —
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top b…
-
Unscored —CVE-2020-9008 Public exploit
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary we…
-
Unscored —
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Desc…
-
Unscored —
LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.
-
Unscored —
LiteCart through 2.2.1 allows CSV injection via a customer's profile.
-
Unscored —
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the W…
-
Unscored —
A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitati…
-
Unscored —
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mul…
-
Unscored —
Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploit…
-
Unscored —CVE-2020-8793 Public exploit
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a comb…
-
Medium 6.2
An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firm…
-
High 8.8
An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A …
-
High 7.5
An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware ver…
-
High 8.0
An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware ver…
-
Unscored —
An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_r…
-
Critical 9.9
An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Mox…
-
Critical 9.9
An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa A…
-
High 7.5
The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic…
-
Critical 9.9
An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131…
-
High 8.8
An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware…
-
High 7.2
An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware vers…
-
High 8.8
An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware versi…
-
High 8.8
An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware versio…
-
Medium 5.3
IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially …
-
Medium 5.9
IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an a…
-
High 8.1
Origin Validation Error in Magento 2
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (mer…
-
High 8.1CVE-2020-8819 Public exploit
CardGate Payments plugin for WooCommerce does not validate request origin
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID…
-
Critical 9.0
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
-
Medium 5.8
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
-
Low 3.1
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_CO…