Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
153 results · Clear filters · Feed
-
Unscored —CVE-2013-2684 Public exploit
Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary we…
-
Unscored —
Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attacker…
-
Critical 9.8
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in includ…
KEV Nov 3, 2021 -
Unscored —CVE-2012-6307 Public exploit
A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a maliciou…
-
Unscored —CVE-2020-8636 Public exploit
An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .
-
Unscored —
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in i…
-
Unscored —
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remo…
-
Unscored —
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtige…
-
Unscored —CVE-2012-2593 Public exploit
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote att…
-
Critical 9.8
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
KEV Nov 3, 2021 -
Unscored —CVE-2013-2682 Public exploit
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain…
-
Unscored —
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers t…
-
Unscored —CVE-2013-2680 Public exploit
Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive i…
-
Medium 5.4CVE-2019-15253 Public exploit
Cisco Digital Network Architecture Center Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface o…
-
Unscored —CVE-2019-15126 Public exploit
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal…
-
Unscored —CVE-2019-12180 Public exploit
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, t…
-
Unscored —
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves …
-
Unscored —
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attacker…
-
Unscored —CVE-2013-7055 Public exploit
D-Link DIR-100 4.03B07 has PPTP and poe information disclosure
-
Unscored —CVE-2013-7054 Public exploit
D-Link DIR-100 4.03B07: cli.cgi XSS
-
Unscored —CVE-2013-7053 Public exploit
D-Link DIR-100 4.03B07: cli.cgi CSRF
-
Unscored —
D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script
-
Unscored —
D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters
-
Unscored —CVE-2012-5686 Public exploit
ZPanel 10.0.1 has insufficient entropy for its password reset process.
-
Medium 5.7CVE-2020-5236 Public exploit
Catastrophic backtracking in regex allows Denial of Service in Waitress
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing th…
-
Critical 9.8
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
-
Unscored —
The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot th…
-
Unscored —CVE-2020-8547 Public exploit
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which …
-
Unscored —CVE-2013-2624 Public exploit
Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitiv…
-
Unscored —CVE-2013-2623 Public exploit
Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via th…
-
Unscored —
Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victi…
-
Critical 9.8
SQL injection in Django
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter).…
-
Critical 9.8
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allo…
KEV Nov 3, 2021