Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module…
-
Medium 5.5
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim'…
-
Unscored —
A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could…
-
Unscored —
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflectiv…
-
Unscored —
A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PM…
-
Medium 6.5
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.2…
-
High 8.2
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
High 8.2
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-…
-
Critical 9.8
AutoUpdater.NET allows XXE
AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
-
High 7.3
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permis…
-
Unscored —
The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might …
-
Unscored —
Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username…
-
Unscored —
An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not val…
-
Unscored —
The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refus…
-
Unscored —
An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received wit…
-
Medium 4.6
webOS TV Emulator privilege escalation vulnerability
A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration …
-
Unscored —
In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Re…
-
Unscored —
Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File …
-
Unscored —CVE-2020-8497 Scanner template
In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format a…
-
Medium 5.4
IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar…
-
Unscored —
NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code w…
-
High 8.8
CodeIgniter Improper Privilege Management
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, th…
-
Unscored —
On NETGEAR GS728TPS devices through 5.3.0.35, a remote attacker having network connectivity to the web-administration p…
-
Medium 5.5
Infinite Loop in Apache Tika
A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
-
High 8.3CVE-2020-6650 Public exploit
Arbitrary code execution through “Update Manager” Class
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software …
-
Unscored —
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionali…
-
Unscored —
An exploitable double free vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. A sp…
-
Medium 5.5
Uncontrolled Resource Consumption in Apache Tika
A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
-
Unscored —
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionali…
-
Unscored —
ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administratio…
-
Critical 9.1
HashiCorp Vault Improper Privilege Management
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.
-
Medium 5.3
HashiCorp Vault Improper Privilege Management
HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.
-
Unscored —
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced…
-
Unscored —
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Serv…
-
Unscored —
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Serv…
-
Unscored —
Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a syste…
-
Unscored —
Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the…