Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
1,406 results · Feed
-
Unscored —
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top b…
-
Unscored —CVE-2020-9008 Public exploit
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary we…
-
Unscored —
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Desc…
-
Unscored —
LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.
-
Unscored —
LiteCart through 2.2.1 allows CSV injection via a customer's profile.
-
Unscored —
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the W…
-
Unscored —
A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitati…
-
Unscored —
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mul…
-
Unscored —
Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploit…
-
Unscored —CVE-2020-8793 Public exploit
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a comb…
-
Medium 6.2
An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firm…
-
High 8.8
An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A …
-
High 7.5
An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware ver…
-
High 8.0
An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware ver…
-
Unscored —
An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_r…
-
Critical 9.9
An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Mox…
-
Critical 9.9
An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa A…
-
High 7.5
The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic…
-
Critical 9.9
An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131…
-
High 8.8
An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware…
-
High 7.2
An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware vers…
-
High 8.8
An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware versi…
-
High 8.8
An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware versio…
-
Medium 5.3
IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially …
-
Medium 5.9
IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an a…
-
High 8.1
Origin Validation Error in Magento 2
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (mer…
-
High 8.1CVE-2020-8819 Public exploit
CardGate Payments plugin for WooCommerce does not validate request origin
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID…
-
Critical 9.0
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
-
Medium 5.8
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
-
Low 3.1
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_CO…
-
Unscored —
A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in up…
-
Unscored —
An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for t…
-
Unscored —
controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/…
-
Critical 9.8
Improper Privilege Management in Tomcat
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…
KEV Mar 3, 2022 -
Medium 4.8
Potential HTTP request smuggling in Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …
-
Medium 4.8
Potential HTTP request smuggling in Apache Tomcat
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Reque…
-
Medium 6.5CVE-2020-1937 Public exploit
SQL Injection in Kylin
Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
-
Unscored —
On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploi…
-
Unscored —
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin…
-
Unscored —CVE-2019-17228 Scanner template
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin…