Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
7 results · Clear filters · Feed
-
Medium 5.3CVE-2020-10883 Public exploit
This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmwar…
-
Medium 6.3CVE-2020-8865 Public exploit
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webm…
-
Medium 4.3CVE-2020-8866 Public exploit
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webma…
-
Medium 4.0CVE-2020-5267 Public exploit
Possible XSS vulnerability in ActionView
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions…
-
Medium 5.4CVE-2020-10596 Public exploit
Cross-site Scripting in OpenCart
OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.
-
Medium 5.6CVE-2020-7598 Public exploit
Prototype Pollution in minimist
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
-
Medium 6.5
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send …