Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
63 results · Clear filters · Feed
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the uncompress_scan_line function of the igcore19d.dll libra…
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll JPEG jpegread precision parser of the Accu…
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the uncompress_scan_line function of the igcore19d.dll libra…
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the bmp_parsing function of the igcore19d.dll library of Acc…
-
Critical 9.8
PDFKit Improper Input Validation vulnerability
Ruby PDFKit gem prior to 0.5.3 has a Code Execution Vulnerability
-
Critical 9.8
TAIWAN SECOM CO., LTD. - Pre-auth SQL Injection
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command.
-
Critical 9.8
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
-
Critical 9.4CVE-2019-17137 Public exploit
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC12…
-
Critical 10.0
Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 a…
-
Critical 10.0
Missing Authentication for Critical Function in Bosch Video Streaming Gateway
Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configuration data of the Video Streaming Gateway. A successful attack can impact the confidentiali…
-
Critical 9.8
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
-
Critical 9.8
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in includ…
KEV Nov 3, 2021 -
Critical 9.8
OS Command Injection in curling
All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
-
Critical 9.8
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
KEV Nov 3, 2021 -
Critical 9.8
Incorrect threshold signature computation in TUF
TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
-
Critical 9.8
Improper Input Validation in network-manager
network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.
-
Critical 9.8
OS Command Injection in im-resize
im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
-
Critical 9.8
OS Command Injection in im-metadata
im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
-
Critical 9.8
Improper Input Validation in klona
Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
-
Critical 9.8
SysJust Syuan-Gu-Da-Shih -Request-Forgery
SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests.
-
Critical 9.8
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
-
Critical 9.8
SQL injection in Django
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter).…
-
Critical 9.8
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allo…
KEV Nov 3, 2021