Archive
17 April 2020
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
Medium 6.1
XSS in svg2png (NPM package)
svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
-
Unscored —
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or …
-
Medium 4.0
WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the …
-
Medium 5.3
Diavante vue-storefront-api and storefront-api disclose stack trace
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.
-
Medium 5.1
An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specif…
-
Unscored —
In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting.
-
Unscored —
In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.
-
Unscored —
In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, whic…
-
Unscored —
OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (su…
-
Unscored —
In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login pa…
-
Unscored —
In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login pag…
-
Unscored —
Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbit…
-
Unscored —
In authorize_enroll of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check…
-
Unscored —
In set_shared_key of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. …
-
Unscored —
In get_auth_result of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check…
-
Unscored —
There is a possible disclosure of RAM using a shared crypto key due to improperly used crypto. This could lead to local…
-
Unscored —
In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds chec…
-
Unscored —
In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds chec…
-
Unscored —
In rw_t2t_extract_default_locks_info of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds…
-
Unscored —
In rw_t2t_update_lock_attributes of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds che…
-
Unscored —
In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer. This could lead to lo…
-
Unscored —
In releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Unscored —CVE-2020-0082 Public exploit
In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe des…
-
Unscored —
In finalize of AssetManager.java, there is possible memory corruption due to a double free. This could lead to local es…
-
Unscored —
In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overla…
-
Unscored —
In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds read due to an integer overflow. This…
-
Unscored —
In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could…
-
Unscored —
An improper signature validation vulnerability in Autodesk Dynamo BIM versions 2.5.1 and 2.5.0 may lead to code executi…
-
Unscored —
A heap overflow vulnerability in the Autodesk FBX-SDK versions 2019.2 and earlier may lead to arbitrary code execution …
-
Unscored —
A NULL pointer dereference vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of serv…
-
Unscored —
An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of …
-
Unscored —
A use-after-free vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to code execution on a syst…
-
Unscored —
A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write…
-
Unscored —
A buffer overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitrary code executio…
-
Unscored —CVE-2019-6203 Public exploit
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS…
-
Unscored —
An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." p…
-
Unscored —
An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." paramet…
-
Unscored —
The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) f…
-
High 7.5
airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of …
-
High 7.5
airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC …