Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
Unscored —
An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is pos…
-
Unscored —CVE-2020-9344 Scanner template
Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
-
Unscored —
An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is pos…
-
High 7.2
SQL Injection in Cloud Native Computing Foundation Harbor
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
-
Medium 4.9
SQL Injection in Cloud Native Computing Foundation Harbor
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
-
High 7.6
Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
-
Unscored —
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.
-
Unscored —
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mecha…
-
Unscored —
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp to see if…
-
Unscored —
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service vi…
-
Unscored —
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a comman…
-
High 7.0
A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vuln…
-
High 7.0
A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification…
-
Unscored —
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection head…
-
Medium 5.3
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An at…
-
Unscored —
Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability …
-
Unscored —
An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allow…
-
High 7.5
phpBB arbitrary CSS injection
phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.
-
Unscored —
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior tha…
-
Unscored —CVE-2019-16068 Public exploit
A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to tr…
-
Unscored —
An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still v…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on th…
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an att…
-
Unscored —
Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation…
-
Medium 6.1
MantisBT XSS when uploading an attachment
The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. T…
-
Unscored —
The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parame…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp.…
-
Unscored —
In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This aff…
-
Unscored —
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateMana…
-
Unscored —
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior tha…
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web appl…
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
-
Unscored —
An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 a…
-
Unscored —CVE-2019-16065 Public exploit
A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows …
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated use…
-
Unscored —
NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for a…
-
High 7.4
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.