Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
Unscored —
An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID parameter in an HTTP hea…
-
Unscored —
An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an una…
-
Unscored —
An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticat…
-
Unscored —
An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an aut…
-
Unscored —
An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an att…
-
Unscored —
An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processS…
-
Unscored —
An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticat…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticat…
-
Unscored —
The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauth…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated a…
-
Unscored —
An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated a…
-
Unscored —
An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthen…
-
Unscored —
An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an auth…
-
Unscored —
An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unaut…
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An …
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacke…
-
Medium 4.4
During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, w…
-
Medium 6.5
The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP…
-
High 7.5
django-nopassword stores secrets in cleartext
django-nopassword before 5.0.0 stores cleartext secrets in the database.
-
Unscored —
An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and ex…
-
Unscored —
An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and ex…
-
Medium 4.6
It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, …
-
Medium 4.7
A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …
-
Unscored —
BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5…
-
Medium 4.3
IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute m…
-
Unscored —
Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download.
-
Unscored —
Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.
-
Unscored —
Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx.
-
Unscored —
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited w…
-
Unscored —
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. Multiple stack-based buffer overflows can be expl…
-
Unscored —
Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exp…
-
Medium 6.1
Moodle XSS Vulnerability
A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.
-
Medium 6.1
Moodle reflected Cross-site Scripting (XSS)
A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.
-
Low 3.7
Moodle Email media URL tokens were not checking for user status
A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the f…
-
Low 3.1
Moodle open redirect vulnerability
A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.
-
Critical 9.8
ArmorX LisoMail - SQL Injection
LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.
-
Unscored —
Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validat…
-
High 7.5
Golang Facebook Thrift servers vulnerable to denial of service
Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to deni…