Archive
9 April 2020
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Medium 5.5
Ubuntu 18.04 Linux kernel i915 incomplete fix for CVE-2019-14615
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel …
-
Medium 5.8
eXtplorer exposes /usr and /etc/extplorer over HTTP
Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible over HTTP. Introduced in the Makefile patch file debian/patches/debian-changes-2.1.0b6+dfsg-1 or debian/patches/adds-a-makefile.patch, this…
-
Unscored —
The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with a…
-
Unscored —
A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) …
-
High 7.4
Junos OS: MX Series: Crafted packets traversing a Broadband Network Gateway (BNG) configured with IPv6 NDP proxy could lead to Denial of Service
Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node, causing a stale MAC address entry. This could caus…
-
Medium 6.5
Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space o…
-
Unscored —
In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles …
-
Unscored —
An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a …
-
Medium 6.4
Kubernetes Operator generates potentially insecure certificates
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator t…
-
Unscored —
A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted di…
-
Medium 6.5
Argo Exposure of Sensitive Information
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
-
Medium 5.5
Information disclosure through error object
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plain…
-
Unscored —
Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the att…
-
Unscored —
Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker…
-
Unscored —CVE-2020-10619 EPSS 14%
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) con…
-
Unscored —
WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacke…
-
Unscored —
WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject syste…
-
Unscored —
An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.…
-
Unscored —
WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.
-
Unscored —
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0…
-
Unscored —
Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (version…
-
Unscored —
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).
-
Unscored —CVE-2020-10551 Public exploit
QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to t…
-
Unscored —
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There is pervasive CSRF.
-
Unscored —
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain se…
-
Unscored —
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain se…
-
Unscored —
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) …
-
Unscored —
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password v…
-
Unscored —
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-functio…
-
Unscored —
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause th…