Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
85 results · Clear filters · Feed
-
Critical 9.8CVE-2020-7602 Public exploit
OS Command Injection in node-prompt-here
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is us…
-
Unscored —
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in …
-
Unscored —CVE-2019-17658 Public exploit
An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior al…
-
Unscored —CVE-2020-0551 Public exploit
Load value injection in some Intel(R) Processors utilizing speculative execution may allow an authenticated user to pot…
-
Unscored —CVE-2020-0887 Public exploit
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
-
Critical 10.0
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol …
KEV Feb 10, 2022 -
High 7.8
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improper…
KEV Jan 28, 2022 -
Unscored —CVE-2020-10387 Public exploit
Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download file…
-
Unscored —
admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Ex…
-
Medium 5.6CVE-2020-7598 Public exploit
Prototype Pollution in minimist
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
-
Critical 9.8
Deserialization of Untrusted Data in Apache ShardingSphere
In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalli…
-
Unscored —CVE-2020-10385 Public exploit
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1…
-
Critical 10.0
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform a…
KEV Nov 3, 2021 -
High 7.8
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient…
KEV Nov 3, 2021 -
High 7.8
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could…
KEV Nov 3, 2021 -
Low 3.9CVE-2020-5254 Public exploit
NetHack hilite_status parsing privilege escalation
In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.
-
Unscored —CVE-2012-1096 Public exploit
NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connec…
-
Critical 9.8
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout RES…
-
Unscored —CVE-2020-9758 Public exploit
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the…
-
High 7.2
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in t…
KEV Mar 25, 2022 -
High 8.8
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands v…
KEV Nov 3, 2021 -
Unscored —
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.ph…
-
Unscored —CVE-2020-9470 Public exploit
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling sessio…
-
Unscored —CVE-2020-8635 Public exploit
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configur…
-
Critical 9.8
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted …
KEV Nov 3, 2021 -
Medium 6.5
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send …
-
High 7.6CVE-2020-5250 Public exploit
Possible information disclosure in PrestaShop
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all inform…
-
Unscored —
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Confi…
-
High 7.8
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configur…
KEV Jun 29, 2023 -
Unscored —
Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilit…
-
Unscored —
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmw…
-
Unscored —CVE-2020-9380 Public exploit
IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script.
-
Unscored —CVE-2019-14079 Public exploit
Access to the uninitialized variable when the driver tries to unmap the dma buffer of a request which was never mapped …
-
Critical 9.8
ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS de…
KEV Mar 25, 2022 -
Unscored —CVE-2020-9372 Public exploit
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or…
-
Unscored —CVE-2020-9371 Public exploit
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php…
-
Unscored —CVE-2018-5951 Public exploit
An issue was discovered in Mikrotik RouterOS. Crafting a packet that has a size of 1 byte and sending it to an IPv6 add…
-
Unscored —CVE-2018-20343 Public exploit
Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1. An attacker could craft a spe…
-
Unscored —
The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which a…
-
Unscored —CVE-2020-8778 Public exploit
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document,…