Archive
16 March 2020
Vulnerabilities first published on this day (UTC), newest first.
89 results · Feed
-
Unscored —
Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name th…
-
Unscored —
Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attac…
-
Unscored —
Oxygen XML Editor 21.1.1 allows XXE to read any file.
-
Unscored —
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
-
Unscored —
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
-
Unscored —
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
-
Unscored —
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submi…
-
Unscored —CVE-2019-20326 Public exploit
A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg…
-
Unscored —
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
-
Unscored —
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of th…
-
High 7.5
Helm uses crypto package vulnerable to panic from malformed X.509 certificate
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
-
Unscored —
libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability tha…
-
Unscored —
Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation.
-
Unscored —
An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report…
-
Unscored —
Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown…
-
Unscored —
An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the admin application is vulnerable to an …
-
Unscored —
An issue was discovered in Halvotec RaQuest 10.23.10801.0. Several features of the application allow stored Cross-site …
-
Unscored —
An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0.
-
Unscored —
cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-50…
-
Unscored —
In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Comman…
-
Unscored —
Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credent…
-
Unscored —
A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassi…
-
Medium 5.3
yargs-parser Vulnerable to Prototype Pollution
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
-
Critical 9.8
Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).
-
Medium 6.5
Unrestricted Upload of File with Dangerous Type in Umbraco CMS
Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
-
Unscored —
In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user …
-
High 8.8
Umbraco CMS Authenticated File Upload
Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.
-
Unscored —
Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses …
-
Unscored —
A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execu…
-
Medium 5.3
Traefik has an Improper Certificate Handling issue
configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.
-
Unscored —
The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the p…
-
Unscored —
For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0…
-
High 7.5
Unraid 6.8.0 allows authentication bypass.
KEV Nov 3, 2021 -
Critical 9.8
Unraid through 6.8.0 allows Remote Code Execution.
KEV Nov 3, 2021 -
Unscored —
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators …
-
Unscored —
VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp.…
-
Unscored —
Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local priv…
-
Unscored —CVE-2019-19945 Public exploit
uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bo…
-
Unscored —
A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to…
-
Unscored —
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a l…