Skip to content
OpenAdvisories

Archive

28 February 2020

Vulnerabilities first published on this day (UTC), newest first.

← January 2020 2020 / February /28 March 2020 →
  1. 11
  2. 23
  3. 336
  4. 474
  5. 566
  6. 672
  7. 768
  8. 821
  9. 9 
  10. 1058
  11. 11210
  12. 12117
  13. 13123
  14. 1434
  15. 151
  16. 167
  17. 1763
  18. 1854
  19. 1962
  20. 2053
  21. 2126
  22. 2211
  23. 236
  24. 2450
  25. 2540
  26. 2633
  27. 2778
  28. 2839
  29. 29 
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.4
    CVE-2020-6803

    Open redirect in Mozilla WebThings Gateway

    An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in.

    Mozilla WebThings Gateway
  • Medium 6.5
    CVE-2015-3006

    Junos: QFX Series: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up

    On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after …

  • Medium 6.5
    CVE-2015-5361

    Junos: FTPS through SRX opens up wide range of data channel TCP ports

    Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions (gates) are specific to source and destination IPs and ports of client and serv…

  • Medium 6.1
    CVE-2020-8127

    Cross-site Scripting in reveal.js

    Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.

    reveal.js npm
  • Medium 6.5
    CVE-2020-5247

    HTTP Response Splitting in Puma

    In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additiona…

    puma puma puma puma Debian RubyGems
  • Medium 6.1
    CVE-2020-9447

    Cross-site Scripting in GwtUpload

    There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS. Cross-site scripting enables attackers to…

    com.googlecode.gwtupload:gwtupload Maven
  • Medium 5.7
    CVE-2019-3698

    nagios cron job allows privilege escalation from user nagios to root

    UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winni…

    SUSE openSUSE Factory SUSE Linux Enterprise Server 12 Linux