Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
1,406 results · Feed
-
Unscored —
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
-
Unscored —
A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to ov…
-
Unscored —
ProjectPier 0.8.8 does not use the Secure flag for cookies
-
Unscored —
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
-
Unscored —
ProjectPier 0.8.8 has stored XSS
-
Unscored —
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
-
Unscored —
Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability
-
Unscored —
vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability
-
Unscored —
opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities
-
Unscored —
opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities
-
Critical 9.8
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
-
Unscored —
-
Unscored —CVE-2013-0192 Public exploit
File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.
-
Unscored —
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate.
-
Unscored —
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny.
-
Unscored —
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
-
Unscored —
Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName param…
-
Unscored —
WordPress Super Cache Plugin 1.3 has XSS.
-
Unscored —
multi_mut is Unmaintained
Last release was about 6 years ago. There is an outstanding [soundness issue](https://github.com/golddranks/multi_mut/issues/1). The maintainer has not responded for two years to the existing soundness issue. Rust compiler has enabled errors relating to LLVM …
-
Unscored —
Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource …
-
Unscored —
Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct…
-
Unscored —
Out of bound access due to Invalid inputs to dapm mux settings which results into kernel failure in Snapdragon Auto, Sn…
-
Unscored —
Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and the…
-
Unscored —
Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling …
-
Unscored —
Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Sna…
-
Unscored —
Out of bound access while allocating memory for an array in camera due to improper validation of elements parameters in…
-
Unscored —
Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is …
-
Unscored —CVE-2019-14041 Public exploit
During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when upda…
-
Unscored —
Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open clos…
-
Unscored —
APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in…
-
Unscored —CVE-2019-14040 Public exploit
Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of…
-
Unscored —
There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting exist…
-
Unscored —
Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdra…
-
Medium 6.5
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can …
-
High 7.8
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerabilit…
KEV Nov 3, 2021 -
Unscored —
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the Auto…
-
Unscored —
An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job …
-
Unscored —
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauth…
-
Unscored —
SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL c…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentic…