Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
1,406 results · Feed
-
Unscored —
Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet.
-
Unscored —
A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A…
-
Unscored —
Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint.
-
Unscored —
Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution.
-
Unscored —
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTU…
-
Unscored —
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTU…
-
Unscored —
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTU…
-
Unscored —
-
High 7.4
Cisco FXOS, IOS XR, and NX-OS Software Cisco Discovery Protocol Denial of Service Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service…
-
Medium 4.8
Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insuf…
-
High 8.8
Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery P…
-
High 8.8
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of st…
KEV Nov 3, 2021 -
High 8.8
Cisco IP Phone Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missin…
-
High 8.8
Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is …
-
Unscored —
Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could …
-
High 7.5
A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102…
-
Medium 5.4CVE-2019-15253 Public exploit
Cisco Digital Network Architecture Center Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface o…
-
Unscored —
IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier…
-
Unscored —
Views Bulk Operations provides enhancements to running bulk actions on views. The module contains an access bypass vuln…
-
Unscored —
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosur…
-
Unscored —CVE-2019-15126 Public exploit
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal…
-
Unscored —CVE-2020-6754 EPSS 95%
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to…
-
Unscored —CVE-2019-12180 Public exploit
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, t…
-
Unscored —
An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. E…
-
Unscored —
GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.
-
Unscored —
GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).
-
Unscored —
GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
-
Unscored —
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.
-
Unscored —
GitLab EE 11.0 and later through 12.7.2 allows XSS.
-
Unscored —
GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
-
Unscored —
GitLab through 12.7.2 allows XSS.
-
Unscored —
GitLab EE 10.1 through 12.7.2 allows Information Disclosure.
-
Critical 9.8
Incorrect threshold signature computation in TUF
TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
-
Unscored —
GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.
-
Unscored —
IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability
-
Unscored —
GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
-
Unscored —
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
-
Medium 6.5
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information c…
-
Medium 4.3
IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Atta…
-
Medium 4.3
IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicio…