Archive
16 March 2020
Vulnerabilities first published on this day (UTC), newest first.
89 results · Feed
-
Unscored —
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and…
-
Unscored —
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered …
-
Unscored —
An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a …
-
Unscored —
An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaS…
-
Unscored —
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CS…
-
High 7.4
Insufficient Nonce Validation in Eclipse Milo Client
In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the net…
-
Unscored —
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of u…
-
Unscored —CVE-2020-10239 Public exploit
An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows ac…
-
Unscored —CVE-2020-10238 Public exploit
An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leadin…
-
Critical 9.8
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Con…
-
Critical 9.8
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Con…
-
High 7.5
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Con…
-
Unscored —
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Con…
-
Unscored —
CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/ad…
-
Unscored —
Nagios Log Server 2.1.3 has Incorrect Access Control.
-
Unscored —
Nagios Log Server 2.1.3 has CSRF.
-
Unscored —CVE-2020-6586 EPSS 19%
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /ad…
-
Medium 6.5
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack tha…
-
Medium 5.1
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitiv…
-
Medium 5.1
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitiv…
-
Medium 5.9
IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could le…
-
Unscored —
Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10…
-
Unscored —
Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP ad…
-
Unscored —
Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allo…
-
Low 3.9
Argument Injection in Ansible
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All ver…
-
Unscored —
An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Su…
-
Low 3.9
Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the re…
-
Medium 4.2
Path Traversal in Ansible
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be …
-
Low 2.2
Incorrect Permission Assignment for Critical Resource in Ansible
A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed t…
-
Medium 6.1
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.
-
Medium 5.4
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.
-
High 7.4
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly c…
-
High 7.5
Dolibarr ERP and CRM SQLi
Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.
-
Critical 9.8
Code injection in codiad
Codiad Web IDE through 2.8.4 allows PHP Code injection.
-
Unscored —
LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in a…
-
Medium 6.1
Cross-site Scripting in Contao
Contao before 4.5.7 has XSS in the system log.
-
Medium 5.0
Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as pass…
-
Unscored —
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
-
Unscored —
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
-
Unscored —
An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged…