Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
High 7.8
PAN-OS: Shell injection vulnerability in PAN-OS CLI allows execution of shell commands
A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1, …
-
High 7.0
PAN-OS: Predictable temporary filename vulnerability allows local privilege escalation
A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtua…
-
Medium 5.0
Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp.…
-
Unscored —
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a deni…
-
Unscored —CVE-2020-8540 EPSS 13%
An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows re…
-
Unscored —
This module enables you to authenticate Drupal users using an external SAML Identity Provider. If the site is configure…
-
Medium 5.9
Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
-
Critical 9.8
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevat…
KEV Nov 3, 2021 -
Unscored —
systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedu…
-
Medium 6.5
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
High 7.5
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Critical 9.8
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
High 7.5
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
High 8.8
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Critical 9.8
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
High 7.5
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Medium 6.2
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Medium 5.3
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Unscored —
Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for a…
-
Critical 9.8
Fat-Free Framework arbitrary code execution
In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
-
Unscored —
oauth/oauth2/v1/saml/ in Abacus OAuth Login 2019_01_r4_20191021_0000 before prior to R4 (20.11.2019 Hotfix) allows Refl…
-
Medium 4.3
phpBB Cross-Site Request Forgery (CSRF)
Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.
-
Unscored —CVE-2020-10385 Public exploit
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1…
-
Unscored —
A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1.…
-
Unscored —
A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.…
-
Unscored —
An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication…
-
Unscored —
An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versio…
-
Critical 9.8
Improper Neutralization of Special Elements used in an OS Command in Blamer
Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.
-
Unscored —
An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 0…
-
Unscored —
An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware v…
-
Unscored —
An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKP…
-
Unscored —
An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT au…
-
Unscored —
An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Fir…
-
Unscored —
An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 …
-
Unscored —
An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 …
-
Unscored —
An exploitable stack buffer overflow vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC…
-
Unscored —
An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management …
-
Unscored —
The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs …
-
Unscored —
An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can…
-
Unscored —
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the paylo…