Archive
19 March 2020
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Unscored —
Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism…
-
Unscored —
The tfo_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file.
-
Unscored —
The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file.
-
High 7.7
GitHub personal access token leaking into temporary EasyBuild (debug) logs
In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, …
-
Unscored —
An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protect…
-
Unscored —
Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escal…
-
Unscored —
In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may…
-
Unscored —
In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may…
-
Medium 5.5
Cisco SD-WAN Solution vManage Stored Cross-Site Scripting Vulnerability
A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the vManage software. The vulnerability is …
-
Medium 5.4CVE-2019-16012 EPSS 54%
Cisco SD-WAN Solution vManage SQL Injection Vulnerability
A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attac…
-
High 7.1
Cisco SD-WAN Solution Buffer Overflow Vulnerability
A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending…
-
High 7.0
Cisco SD-WAN Solution Privilege Escalation Vulnerability
A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerab…
-
High 7.8
Cisco SD-WAN Solution Command Injection Vulnerability
A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit…
-
Unscored —
In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may…
-
High 7.0
A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an …
-
Medium 6.5
In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Ball…
-
Medium 6.5
In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Ba…
-
Medium 6.5
In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc …
-
Medium 6.5
In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc …
-
Medium 6.5
In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Ballo…
-
Medium 6.5
In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc …
-
Medium 6.1
Injection in DeltaSpike
we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default.
-
Unscored —
In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, a…
-
Unscored —
ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter.
-
Unscored —
ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter.
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
-
Unscored —
ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.
-
Unscored —
In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, an…
-
Unscored —
In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, an…
-
Unscored —
In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and…
-
Medium 5.0
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, …
-
Medium 4.9
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privil…
-
Unscored —
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images…
-
High 7.5
Infinite Loop in jsonparser
The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.
-
Medium 5.4
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3…
-
Medium 6.5
The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without c…
-
Unscored —
qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, whi…
-
Unscored —
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through …