Archive
14 April 2020
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
Medium 4.8
CSRF and DNS Rebinding in Oasis
Oasis before version 2.15.0 has a potential DNS rebinding or CSRF vulnerability. If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use DNS rebinding and CSRF attacks to read…
-
Medium 5.8
Possible XSS attack in Wagtail
In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craf…
-
Critical 9.3
malicious URLs may cause Git to present stored credentials to the wrong server
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure stor…
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDee…
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompre…
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demons…
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress …
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated …
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by D…
-
Medium 5.1
Internal NCryptDecrypt method could be used externally from WindowsHello library.
The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and w…
-
High 7.3
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation b…
-
High 7.3
A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundatio…
-
Medium 5.0
A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1…
-
High 7.3
A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that …
-
Medium 4.4
A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to …
-
Unscored —
Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devic…
-
Unscored —
An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement…
-
Unscored —
A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) …
-
Unscored —
A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) …
-
High 7.5
A vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X…
-
Unscored —
A vulnerability has been identified in TIM 3V-IE (incl. SIPLUS NET variants) (All versions < V2.8), TIM 3V-IE Advanced …
-
Medium 6.1
SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect use…
-
Medium 6.1
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752…
-
Critical 9.1
SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.3…
-
Medium 6.4
SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, …
-
Unscored —CVE-2019-14326 Public exploit
An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23)…
-
Unscored —
Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the s…
-
Critical 9.3
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet x…
-
High 7.2
SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group pr…
-
High 7.2
SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root priv…
-
Medium 5.3
SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missin…
-
High 7.5
Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web applicat…
-
High 8.6
SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalitie…
-
Medium 4.3
SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allow…
-
Critical 9.1
SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that c…
-
Medium 5.4
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficient…
-
Medium 5.4
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficient…
-
Medium 5.3
SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an atta…