Skip to content
OpenAdvisories

Archive

7 April 2020

Vulnerabilities first published on this day (UTC), newest first.

← March 2020 2020 / April /7 May 2020 →
  1. 1108
  2. 256
  3. 326
  4. 48
  5. 51
  6. 643
  7. 7126
  8. 8139
  9. 930
  10. 1017
  11. 11 
  12. 1217
  13. 1342
  14. 1474
  15. 15513
  16. 16167
  17. 1774
  18. 181
  19. 194
  20. 2064
  21. 2165
  22. 22127
  23. 2393
  24. 2470
  25. 25 
  26. 263
  27. 2786
  28. 2899
  29. 2983
  30. 3055
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.1
    CVE-2020-11611

    Open Redirect in xdLocalStorage

    An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loade…

    xdlocalstorage npm
  • Medium 5.3
    CVE-2020-7618

    Prototype Pollution in sds

    sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.

    sds npm
  • Medium 5.3
    CVE-2020-7616

    Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware

    express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory…

    express-mock-middleware npm
  • Medium 5.4
    CVE-2020-2175

    Stored XSS vulnerability in Jenkins FitNesse Plugin

    Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the …

    Jenkins Project Jenkins FitNesse Plugin org.jenkins-ci.plugins:fitnesse Web / CMS Maven
  • Medium 5.4
    CVE-2020-2176

    XSS vulnerability in Jenkins useMango Runner Plugin

    Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from…

    Jenkins Project Jenkins useMango Runner Plugin it.infuse.jenkins:usemango-runner Web / CMS Maven
  • Medium 6.1
    CVE-2020-2173

    XSS vulnerability in Jenkins Gatling Plugin

    Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able to change report content.

    Jenkins Project Jenkins Gatling Plugin org.jenkins-ci.plugins:gatling Web / CMS Maven
  • Medium 6.1
    CVE-2020-2174

    Reflected XSS vulnerability in Jenkins AWSEB Deployment Plugin

    Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a reflected cross-site scripting vulnerability.

    Jenkins Project Jenkins AWSEB Deployment Plugin br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin Web / CMS Maven
  • Medium 6.3
    CVE-2020-8096

    Untrusted Search Path Vulnerability in High-Level Antimalware SDK

    Untrusted Search Path vulnerability in Bitdefender High-Level Antimalware SDK for Windows allows an attacker to load third party code from a DLL library in the search path. This issue affects: Bitdefender High-Level Antimalware SDK for Windows versions prior …

    Bitdefender High-Level Antimalware SDK for Windows Windows