25 March 2020

14 results · Clear filters · Feed

• High 7.2
  CVE-2020-10963 Public exploit EPSS 15%

  FrozenNode Laravel-Administrator unrestricted file upload

  FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is…

  frozennode/administrator Packagist
  Mar 25, 2020
• High 8.1
  CVE-2020-10887

  This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 …

  TP-Link Systems Archer A7 Network devices
  Mar 25, 2020
• High 8.1
  CVE-2020-10885

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Fir…

  TP-Link Systems Archer A7 Network devices
  Mar 25, 2020
• High 8.1
  CVE-2020-10886

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Fir…

  TP-Link Systems Archer A7 Network devices
  Mar 25, 2020
• High 8.1
  CVE-2020-10884 Public exploit EPSS 39%

  This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer…

  TP-Link Systems Archer A7 Network devices
  Mar 25, 2020
• High 8.8
  CVE-2020-10882 Public exploit EPSS 41%

  This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arc…

  TP-Link Systems Archer A7 Network devices
  Mar 25, 2020
• High 7.2
  CVE-2020-5282

  arbitrary shell execution in Nick Chan Bot

  In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta

  Nick Chan nickchanbot
  Mar 25, 2020
• High 7.6
  CVE-2020-5280

  Local file inclusion vulnerability in http4s

  http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticc…

  http4s http4s org.http4s:http4s-server_2.12 Maven
  Mar 25, 2020
• High 7.6
  CVE-2020-2171

  XXE vulnerability in Jenkins RapidDeploy Plugin

  Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins RapidDeploy Plugin org.jenkins-ci.plugins:rapiddeploy-jenkins Web / CMS Maven
  Mar 25, 2020
• High 8.8
  CVE-2020-2167

  RCE vulnerability in Jenkins OpenShift Pipeline Plugin

  Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

  Jenkins Project Jenkins OpenShift Pipeline Plugin com.openshift.jenkins:openshift-pipeline Web / CMS Maven
  Mar 25, 2020
• High 8.8
  CVE-2020-2168

  RCE vulnerability in Jenkins Azure Container Service Plugin

  Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

  Jenkins Project Jenkins Azure Container Service Plugin org.jenkins-ci.plugins:azure-acs Web / CMS Maven
  Mar 25, 2020
• High 8.8
  CVE-2020-2166

  RCE vulnerability in Jenkins Pipeline: AWS Steps Plugin

  Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

  Jenkins Project Jenkins Pipeline: AWS Steps Plugin de.taimos:pipeline-aws Web / CMS Maven
  Mar 25, 2020
• High 8.8
  CVE-2020-2160

  Cross-Site Request Forgery in Jenkins

  Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Mar 25, 2020
• High 8.2
  CVE-2020-5261

  Missing Token Replay Detection

  Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign O…

  Sustainsys Saml2 Sustainsys.Saml2 NuGet
  Mar 25, 2020