Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
1,762 results · Feed
-
High 7.5CVE-2020-4276 Public exploit
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerabili…
-
Medium 4.7
python-apt uses MD5 for validation
python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered p…
-
Medium 4.7
python-apt downloads from untrusted sources
Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shou…
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
-
Unscored —
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text…
-
Medium 6.5
Auth Bypass in Google's Closure-Library
A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
-
Medium 5.4
XSS in Dart
An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SD…
-
High 8.6CVE-2020-1764 Public exploit
Hard coded cryptographic key in Kiali
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possib…
-
High 7.3
MACC installer DLL side loading
DLL Side Loading vulnerability in the installer for McAfee Application and Change Control (MACC) prior to 8.3 allows local users to execute arbitrary code via execution from a compromised folder.
-
Unscored —
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
-
Unscored —
A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP s…
-
Unscored —
Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/reseta…
-
Unscored —
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header…
-
Unscored —
Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed…
-
High 7.2
FrozenNode Laravel-Administrator unrestricted file upload
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is…
-
Unscored —
When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, re…
-
Unscored —
By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resiz…
-
Unscored —
When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been e…
-
Unscored —
When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML do…
-
Unscored —
When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was poss…
-
Unscored —
After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification t…
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be …
-
Unscored —
The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's …
-
Unscored —
When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block co…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evide…
-
Unscored —
Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evide…
-
Medium 4.8
RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Securit…
-
Medium 4.8
RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Securit…
-
Unscored —
A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7. The vulnerabi…
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors …
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds…
-
Unscored —
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exp…
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corrupt…
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds…
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds…
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corrupt…
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors …
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds…
-
Unscored —
Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors …