Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
153 results · Clear filters · Feed
-
Unscored —
An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQ…
-
Unscored —CVE-2020-9442 Public exploit
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corr…
KEV Nov 3, 2021 -
High 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.…
KEV Jun 27, 2022 -
Unscored —CVE-2020-6864 Public exploit
ZTE E8820V3 router product is impacted by an information leak vulnerability. Attackers could use this vulnerability to …
-
Unscored —CVE-2017-6371 Public exploit
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string…
-
Unscored —
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
-
Unscored —CVE-2020-8809 Public exploit
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connec…
-
Unscored —CVE-2019-3999 Public exploit
Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, …
-
Unscored —CVE-2020-9008 Public exploit
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary we…
-
Unscored —
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mul…
-
Unscored —CVE-2020-8793 Public exploit
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a comb…
-
High 8.1CVE-2020-8819 Public exploit
CardGate Payments plugin for WooCommerce does not validate request origin
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID…
-
Critical 9.8
Improper Privilege Management in Tomcat
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…
KEV Mar 3, 2022 -
Medium 6.5CVE-2020-1937 Public exploit
SQL Injection in Kylin
Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
-
Unscored —
On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploi…
-
High 7.9CVE-2020-5245 Public exploit
Remote Code Execution (RCE) vulnerability in dropwizard-validation
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Th…
-
Unscored —
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in …
-
Unscored —
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly ot…
-
Unscored —CVE-2012-3351 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attacker…
-
Unscored —
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficien…
-
Unscored —
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path…
-
Unscored —CVE-2014-7951 Public exploit
Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate at…
-
Unscored —
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a …
-
Unscored —CVE-2012-2629 Public exploit
Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier al…
-
High 7.5
Improper Verification of Cryptographic Signature in golang.org/x/crypto
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
-
Unscored —CVE-2014-9613 Public exploit
Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL c…
-
Unscored —CVE-2014-9612 Public exploit
SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.…
-
Medium 6.5
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the…
KEV Oct 24, 2022 -
Unscored —CVE-2012-0055 Public exploit
OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security che…
-
Unscored —CVE-2015-7567 Public exploit
SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "pass…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow re…
-
Unscored —CVE-2015-6970 Public exploit
The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows …
-
Unscored —
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerab…
-
Unscored —
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling v…
-
Unscored —
Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary…
-
Unscored —CVE-2014-1947 Public exploit
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remot…
-
Unscored —
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before…
-
Medium 5.4CVE-2020-9038 Public exploit
Cross-site Scripting in Joplin
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
-
Unscored —
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code exec…