Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
1,406 results · Feed
-
Unscored —
-
Unscored —
HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information
-
Unscored —
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
-
Unscored —
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
-
Unscored —CVE-2014-5083 Public exploit
A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php…
-
Unscored —
An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedde…
-
Unscored —
The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploa…
-
Unscored —CVE-2014-5084 Public exploit
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let…
-
Unscored —CVE-2014-5085 Public exploit
A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, wh…
-
Medium 6.1
XSS in Keycloak
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other r…
-
Unscored —CVE-2014-5086 Public exploit
A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrit…
-
Unscored —
Orange HRM 2.7.1 allows XSS via the vacancy name.
-
Unscored —
vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
-
Unscored —
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third…
-
Unscored —
The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this …
-
Unscored —
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash …
-
Unscored —CVE-2019-20059 Public exploit
payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values…
-
Unscored —
slice-deque is unmaintained
The author of the `slice-deque` crate is unresponsive and is not receiving security patches. Maintained alternatives: - [`slice-ring-buffer`](https://crates.io/crates/slice-ring-buffer)
-
Unscored —
lzw is unmaintained
The author of the `lzw` crate is unresponsive. Maintained alternatives: - [`weezl`](https://crates.io/crates/weezl)
-
Unscored —CVE-2020-8825 Public exploit
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
-
Medium 6.5
global buffer-overflow in mbfl_filt_conv_big5_wchar
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buff…
-
Medium 6.5
OOB read in php_strip_tags_ex
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to informa…
-
Medium 6.1
Cross-site scripting in SocksJS-node
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
-
Unscored —
Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
-
Unscored —
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running…
-
Unscored —
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_web…
-
Unscored —
The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service…
-
Unscored —
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remo…
-
Unscored —
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier…
-
Unscored —
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attacker…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote au…
-
Unscored —
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated u…
-
High —
jQuery File Upload Plugin Unrestricted file upload vulnerability
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joom…
-
Unscored —
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow rem…
-
Unscored —
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remot…
-
Unscored —
Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote au…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inje…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork …
-
Unscored —CVE-2014-2225 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow rem…