Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
1,406 results · Feed
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and i…
-
Unscored —
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.…
-
Unscored —
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 an…
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Users removed from …
-
Unscored —
The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Cat…
-
Unscored —
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An ap…
-
Unscored —
The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. …
-
Unscored —
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5…
-
Unscored —
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. …
-
Unscored —
A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state managem…
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1…
-
Unscored —
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. …
-
Unscored —
An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bo…
-
High 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.…
KEV Jun 27, 2022 -
Unscored —
An access issue was addressed with improved memory management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, mac…
-
Medium 5.5
Files added to tar with Phar::buildFromIterator have all-access permissions
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesys…
-
High 7.5
Null Pointer Dereference in PHP Session Upload Progress
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload proce…
-
Medium 6.5
heap-buffer-overflow in phar_extract_file
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosur…
-
High 8.8
UAA fails to check the state parameter when authenticating with external IDPs
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
-
High 8.0
Cloud Controller logs environment variables from app manifests
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unau…
-
Medium 5.3
Cloud Foundry GoRouter is vulnerable to cache poisoning
Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.
-
Medium —
Cross-site Scripting in Apache Struts
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
-
Unscored —
Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information wh…
-
Unscored —
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate val…
-
Unscored —
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate v…
-
Unscored —
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate v…
-
Unscored —CVE-2020-6864 Public exploit
ZTE E8820V3 router product is impacted by an information leak vulnerability. Attackers could use this vulnerability to …
-
Unscored —
ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulne…
-
Unscored —
An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain…
-
Unscored —
There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an a…
-
Medium 6.3
IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Autom…
-
Unscored —CVE-2017-6371 Public exploit
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string…
-
Unscored —
In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c…
-
Medium 6.4
TONNET DVR – Firmware Injection
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system.
-
High 8.1
TONNET DVR – Broken Access Control
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default password and gain access to the system.
-
Unscored —
Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Fo…
-
Unscored —
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower,…
-
Unscored —
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
-
Unscored —
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shi…