Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
Unscored —
npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to JBIG2Decode CNxJBIG2DecodeStream Heap Corruption at npdf!CAPP…
-
High 8.8
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands v…
KEV Nov 3, 2021 -
Unscored —
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.ph…
-
Unscored —CVE-2020-10214 EPSS 18%
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binar…
-
Unscored —
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands…
-
Unscored —
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands…
-
Unscored —
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands…
-
Unscored —
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login p…
-
Unscored —CVE-2020-9470 Public exploit
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling sessio…
-
Medium 6.1
CKEditor 4.0 vulnerability in the HTML Data Processor
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
-
Unscored —
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file m…
-
Unscored —CVE-2020-8635 Public exploit
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configur…
-
Unscored —
upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blockin…
-
Unscored —
Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affect…
-
Unscored —
Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected …
-
Unscored —
Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By defau…
-
Unscored —
Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the repo…
-
Unscored —
Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vu…
-
Critical 9.8
Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough au…
-
High 8.1
Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerab…
-
Unscored —
ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an arc…
-
High 7.5
Uncontrolled Resource Consumption in urllib3
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. …
-
Unscored —
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (w…
-
Unscored —
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) …
-
Unscored —
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (w…
-
Unscored —
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) …
-
Unscored —
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge req…
-
Unscored —
GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
-
Unscored —
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), …
-
Unscored —
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) m…
-
Critical 9.8
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted …
KEV Nov 3, 2021 -
Unscored —
Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. The IOCTL Codes 0x80102050…
-
Unscored —CVE-2020-10188 EPSS 74%
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes o…
-
High —
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
### Impact The [`verifyVerifiableCredential()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.ts#L57) method check the cryptographic integrity of the Verifiable Credential, but it does not check…
-
High —
Holder can generate proof of ownership for credentials it does not control in vp-toolkit
### Impact The [`verifyVerifiablePresentation()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-presentation-signer.ts#L97) method check the cryptographic integrity of the Verifiable Presentation, but it does not…
-
Unscored —
usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
-
Unscored —
The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows rem…
-
Unscored —
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue i…
-
High 7.5
In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, c…
-
Unscored —
In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged,…