Archive
18 March 2020
Vulnerabilities first published on this day (UTC), newest first.
72 results · Feed
-
Unscored —
arxes-tolina 3.0.0 allows User Enumeration.
-
Unscored —
A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering for…
-
Unscored —
PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argume…
-
Unscored —
LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the data…
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
-
High 8.8CVE-2020-10673 Public exploit
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
-
Medium 4.8
Network Security Management (NSM) - Cross site scripting vulnerability
Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
-
Medium 4.8
Network Security Management (NSM) - Cross site scripting vulnerability
Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
-
Unscored —
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of…
-
Unscored —
Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation …
-
Unscored —CVE-2020-10665 Public exploit
Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnos…
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.
-
High 7.5
Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulne…
-
Critical 9.1
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to pa…
-
Critical 9.1
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to pa…
-
Unscored —
Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.
-
Medium 4.7
ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
-
Unscored —
In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a craf…
-
Unscored —
SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request For…
-
Unscored —
The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src …
-
Unscored —
The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a…
-
Unscored —
The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via …
-
Unscored —
The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via …
-
Unscored —
In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were …
-
Unscored —
The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src …
-
Unscored —
The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a s…
-
Unscored —
An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID parameter in an HTTP hea…
-
Unscored —
An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an una…
-
Unscored —
An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticat…
-
Unscored —
An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an aut…
-
Unscored —
An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an att…
-
Unscored —
An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processS…
-
Unscored —
An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticat…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticat…
-
Unscored —
The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauth…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated a…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated a…
-
Unscored —
An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthen…