Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
Unscored —
An issue was discovered on Samsung mobile devices with O(8.0), P(9.0), and Q(10.0) (Broadcom chipsets) software. A kern…
-
Unscored —
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower,…
-
Unscored —
In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed b…
-
Unscored —
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in …
-
Medium 4.3
IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid …
-
Medium 6.3
IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to imperso…
-
Medium 6.1
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows use…
-
Medium 5.9
IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an at…
-
High 7.5
Incorrect Account Used for Signing
### Impact Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected. The v…
-
Unscored —
Acyba AcyMailing before 6.9.2 mishandles file uploads by admins.
-
Unscored —CVE-2020-10931 EPSS 28%
Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary p…
-
Unscored —
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attacke…
-
Critical 9.8
Improper Input Validation in PyYAML
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the lib…
-
Unscored —
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
-
Medium 5.6
Exposure of Sensitive Information in keycloak
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector do…
-
Unscored —
Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usa…
-
High 7.9
Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after th…
-
Medium 5.0
Malicious package may avoid detection in python auditing
The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-s…
-
Unscored —
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling a…
-
Unscored —
Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Se…
-
Unscored —
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the no…
-
Unscored —
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling a…
-
Unscored —
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling a…
-
Unscored —
Motorola FX9500 devices allow remote attackers to read database files.
-
High 8.8CVE-2020-8864 EPSS 82%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 8.8CVE-2020-8863 EPSS 78%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
Medium 5.3
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG El…
-
Unscored —
In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platfo…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve…
-
Medium 6.3CVE-2020-8865 Public exploit
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webm…
-
Medium 4.3CVE-2020-8866 Public exploit
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webma…
-
Unscored —
In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the…
-
Unscored —
In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NO…
-
Unscored —
In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the…
-
Critical 9.8
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via craft…
KEV Jan 28, 2022 -
Unscored —
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All vers…
-
Unscored —
A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Ando…
-
Unscored —
A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Ando…
-
Unscored —
A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the s…
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the s…