Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
Unscored —
ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter.
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
-
Unscored —
ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.
-
Unscored —
In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, an…
-
Unscored —
In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, an…
-
Unscored —
In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and…
-
Medium 5.0
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, …
-
Medium 4.9
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privil…
-
Unscored —
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images…
-
High 7.5
Infinite Loop in jsonparser
The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.
-
Medium 5.4
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3…
-
Medium 6.5
The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without c…
-
Unscored —
qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, whi…
-
Unscored —
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through …
-
Unscored —
arxes-tolina 3.0.0 allows User Enumeration.
-
Unscored —
A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering for…
-
Unscored —
PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argume…
-
Unscored —
LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the data…
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
-
High 8.8CVE-2020-10673 Public exploit
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
-
Medium 4.8
Network Security Management (NSM) - Cross site scripting vulnerability
Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
-
Medium 4.8
Network Security Management (NSM) - Cross site scripting vulnerability
Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
-
Unscored —
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of…
-
Unscored —
Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation …
-
Unscored —CVE-2020-10665 Public exploit
Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnos…
-
Medium 6.1
Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.
-
High 7.5
Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulne…
-
Critical 9.1
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to pa…
-
Critical 9.1
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to pa…
-
Unscored —
Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.
-
Medium 4.7
ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
-
Unscored —
In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a craf…
-
Unscored —
SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request For…
-
Unscored —
The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src …
-
Unscored —
The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a…
-
Unscored —
The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via …
-
Unscored —
The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via …
-
Unscored —
In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were …
-
Unscored —
The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src …
-
Unscored —
The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a s…