Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
140 results · Clear filters · Feed
-
High 7.7
openHAB exec add-ons allow remote arbitrary command execution
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands ne…
-
High 7.6
IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is v…
-
High 7.5
Moped Rubygem Data Injection Vulnerability
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted stri…
-
High 7.5
BSON rubygem contains potential denial of service
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015…
-
High 7.5
Improper Verification of Cryptographic Signature in golang.org/x/crypto
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
-
High 8.4
Cisco IOS XE SD-WAN Software Default Credentials Vulnerability
A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected …
-
High 8.8
Cisco Data Center Network Manager Privilege Escalation Vulnerability
A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the application. The vulnerability is due to insufficient access control validation. An attacker could …
-
High 8.8
Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insuffic…
-
High 7.0
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. …
-
High 8.0
TIBCO EBX Exposes Cross-Site Scripting Vulnerability
The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS…
-
High 8.8
Silverstripe CSRF Protection Bypass via GraphQL
In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a bu…
-
High 7.5
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauth…
-
High 7.5
Nokogiri is vulnerable to XML External Entity (XXE) attack
Nokogiri before 1.5.4 is vulnerable to XXE attacks
-
High 8.6
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api…
-
High 8.8
codecov NPM module allows remote attackers to execute arbitrary commands
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2…
-
High 7.1
Asset Suite Direct Object Reference Access
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the res…
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (mais…
-
High 8.1
Cross-Site Request Forgery in Moodle
Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.
-
High 7.5
TaffyDB can allow access to any data items in the DB
taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data …
-
High 7.5
An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 th…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EI…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29…
-
High 7.8CVE-2020-8856 EPSS 20%
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29…
-
High 7.8CVE-2020-8845 EPSS 19%
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0…
-
High 7.8CVE-2020-8846 EPSS 20%
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0…
-
High 7.8CVE-2020-8844 EPSS 24%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25…
-
High 7.5
IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operat…
-
High 8.8CVE-2020-0022 Public exploit
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds ca…
-
High 8.7
Unspecified vulnerability in the fetchmail script in Mailu
In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are …
-
High 7.7
XSS/Script injection vulnerability in matestack
matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.
-
High 7.5
Expedition Migration Tool: Insufficient Cross Site Request Forgery protection.
Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expeditio…