Archive
20 March 2020
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Critical 9.8
SVGlib Vulnerable to XXE Attacks
The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
-
Unscored —
An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php…
-
Unscored —
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress al…
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attacke…
-
Unscored —
Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.
-
Unscored —
Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.…
-
Unscored —
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any…
-
Unscored —
An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a…
-
Unscored —
A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client wi…
-
Unscored —
A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be d…
-
Unscored —
A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
High 7.8CVE-2020-8880 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.8CVE-2020-8882 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.8CVE-2020-8881 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.8CVE-2020-8878 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Unscored —
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_ap…
-
High 8.1
Server-side request forgery in Ghost CMS
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.
-
Critical 9.8
Code injection in blamer
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
-
High —
Server-Side Request Forgery in @uppy/companion
The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.
-
High 7.5
Uncontrolled Resource Consumption in fastify-multipart
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.
-
Critical 9.8
Deserialization of Untrusted Data in Liferay Portal
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
KEV Nov 3, 2021 -
Unscored —CVE-2020-10558 Public exploit
The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due t…
-
Unscored —
openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placi…
-
Unscored —
An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve save…
-
Unscored —
Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted …
-
Unscored —
An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to valid…
-
Unscored —
Tellabs Optical Line Terminal (OLT) 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. Tel…
-
Unscored —
An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to valid…
-
Unscored —
An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to valid…
-
Unscored —
The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by m…
-
Unscored —
An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have…
-
Unscored —
An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to valid…
-
Unscored —
An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to valid…
-
Unscored —
There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has…
-
Unscored —
There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient aut…
-
Unscored —
Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain so…
-
Unscored —
There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient aut…