Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
156 results · Clear filters · Feed
-
Medium 4.3
This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1…
-
Medium 5.5
This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Brow…
-
Medium 6.1
XSS in Keycloak
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other r…
-
Medium 6.5
global buffer-overflow in mbfl_filt_conv_big5_wchar
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buff…
-
Medium 6.5
OOB read in php_strip_tags_ex
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to informa…
-
Medium 6.1
Cross-site scripting in SocksJS-node
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
-
Medium 6.3
Integer overflow in bson_ensure_space
Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.
-
Medium 4.2
Race condition between reading current working directory and writing a core dump
Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.
-
Medium 5.4
External Interface does not invalidate session
The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions.
-
Medium 6.5
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can …
-
Medium 6.2
Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploi…
-
Medium 6.1
bbPress Cross-site Scripting (XSS) vulnerability
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
-
Medium 4.8
Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insuf…
-
Medium 5.4CVE-2019-15253 Public exploit
Cisco Digital Network Architecture Center Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface o…
-
Medium 6.5
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information c…
-
Medium 4.3
IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Atta…
-
Medium 4.3
IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicio…
-
Medium 4.9
Uncontrolled Resource Consumption in strapi
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
-
Medium 5.3
Improper Validation and Sanitization in url-parse
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
-
Medium 6.6
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated use…
-
Medium 6.8
IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it …
-
Medium 6.8
IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker co…
-
Medium 5.3
IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality a…
-
Medium 6.1
IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persu…
-
Medium 6.5
IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass …
-
Medium 5.3
IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM…
-
Medium 5.9
IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to …
-
Medium 5.4
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…
-
Medium 6.1
SysJust Syuan-Gu-Da-Shih -Cross-Site Scripting(XSS)
SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked to attackers via the vulnerability.
-
Medium 5.7CVE-2020-5236 Public exploit
Catastrophic backtracking in regex allows Denial of Service in Waitress
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing th…
-
Medium 6.5
Out-of-memory condition in Nanopb is potentially exploitable
There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PB_ENABLE_MALLOC, the message to be decoded contains a repeated string, bytes or message field and realloc() runs out of memo…
-
Medium 6.1
Bromium client - out of bound read results in race condition causing Kernel memory leaks or denial of service
Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service.
-
Medium 6.1
auth0-lock vulnerable to XSS via unsanitized placeholder property
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.
-
Medium 4.8
kubectl cp allows symlink directory traversal
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in th…
-
Medium 5.3
DCE extension for Typo3 Discloses Environment Information
The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request.
-
Medium 6.1
ServiSign Windows Versions- Arbitrary File Access
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.