Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
High 7.7
Prototype pollution in dojo
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulat…
-
High 7.7
Prototype Pollution in Dojox
In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates…
-
Unscored —
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer …
-
Medium 4.3
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search re…
-
Unscored —
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable…
-
Unscored —
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to …
-
Unscored —
An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a re…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with u…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of t…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues,…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to …
-
Low 3.9CVE-2020-5254 Public exploit
NetHack hilite_status parsing privilege escalation
In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.
-
Unscored —CVE-2012-1096 Public exploit
NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connec…
-
Low 3.9
Privilege escalation in NetHack
NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
-
High 7.5
JBoss AS may expose root content if excluded-contexts list is mismatched
JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
-
Unscored —
Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations ag…
-
Unscored —
An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql serv…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characte…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI w…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able t…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were …
-
Unscored —
Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure th…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute Ja…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of in…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Serv…
-
Unscored —
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of inpu…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature co…
-
High 8.1
Insufficient Verification of Data Authenticity in Eclipse Theia
In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug o…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access th…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an au…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory …
-
Unscored —
Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS.
-
Unscored —CVE-2017-10992 EPSS 10%
In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS co…
-
Unscored —
Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the…
-
Unscored —
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated user…