Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
1,406 results · Feed
-
Unscored —
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.…
-
Unscored —
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
-
Unscored —
Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from…
-
Unscored —
A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.
-
Unscored —
Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.
-
Unscored —
Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circl…
-
Unscored —
Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextclo…
-
Unscored —
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checkin…
-
Unscored —
A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is…
-
Unscored —
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Ne…
-
Medium 5.3
Improper Validation and Sanitization in url-parse
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
-
Critical 9.8
Improper Input Validation in klona
Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
-
Unscored —
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves …
-
Unscored —
phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from …
-
Unscored —
mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root beca…
-
Medium 6.6
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated use…
-
Medium 6.8
IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it …
-
Medium 6.8
IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker co…
-
Medium 5.3
IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality a…
-
Low 3.7
IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if un…
-
Medium 6.1
IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persu…
-
Medium 6.5
IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass …
-
Medium 5.3
IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM…
-
Medium 5.9
IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to …
-
Medium 5.4
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…
-
Unscored —
On Samsung mobile devices with O(8.0) and P(9.0) software and an Exynos 8895 chipset, RKP (aka the Samsung Hypervisor E…
-
Unscored —
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attacker…
-
Unscored —
PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Bui…
-
Unscored —
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via …
-
Unscored —
Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attacke…
-
Unscored —CVE-2013-7055 Public exploit
D-Link DIR-100 4.03B07 has PPTP and poe information disclosure
-
Unscored —CVE-2013-7054 Public exploit
D-Link DIR-100 4.03B07: cli.cgi XSS
-
Unscored —CVE-2013-7053 Public exploit
D-Link DIR-100 4.03B07: cli.cgi CSRF
-
Unscored —
D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script
-
Unscored —
D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters
-
Unscored —
webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
-
Unscored —CVE-2012-5686 Public exploit
ZPanel 10.0.1 has insufficient entropy for its password reset process.
-
Unscored —
Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.
-
Unscored —
Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.
-
Unscored —
Joomla! core 1.7.1 allows information disclosure due to weak encryption