Archive
22 April 2020
Vulnerabilities first published on this day (UTC), newest first.
30 results · Clear filters · Feed
-
Medium 6.1CVE-2020-7350 Public exploit
Metasploit Framework Plugin Libnotify Command Injection
Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially…
-
Medium 6.5
World writable root owned lock file created in user controllable location
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply cont…
-
Medium 5.6
Apport race condition in crash report permissions
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when t…
-
Medium 5.3
Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hand…
-
Medium 6.8
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D7800 before 1.0.1.34,…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WNDR3700v4 before 1.0.…
-
Medium 4.7
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.3…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8300 befo…
-
Medium 6.8
NETGEAR R8000 devices before 1.0.4.2 are affected by a stack-based buffer overflow by an authenticated user.
-
Medium 6.5
Certain NETGEAR devices are affected by denial of service. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.22, …
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34,…
-
Medium 6.5
Certain NETGEAR devices are affected by denial of service. This affects GS110EMX before 1.0.0.9, GS810EMX before 1.0.0.…
-
Medium 5.4
Cross-site scripting in lazysizes
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
-
Medium 5.2
Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 5.0.5.4 …
-
Medium 4.6
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D6220 before 1.0.0.…
-
Medium 6.8
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R7800 before 1.0.2.36,…
-
Medium 6.7
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before V1.0.0.55…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44,…
-
Medium 6.2
ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Information Exposure
The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plaintext (although hidden when displayed).
-
Medium 6.2
Certain NETGEAR devices are affected by denial of service. This affects D6200 before 1.1.00.24, D7000 before 1.0.1.52, …
-
Medium 6.2
ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentials
The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext.
-
Medium 5.0
Certain NETGEAR devices are affected by XSS. This affects D6200 before 1.1.00.24, D7000 before 1.0.1.52, JNR1010v2 befo…
-
Medium 5.0
Certain NETGEAR devices are affected by XSS. This affects D6200 before 1.1.00.24, D7000 before 1.0.1.52, JNR1010v2 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44,…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 befo…
-
Medium 4.2
Certain NETGEAR devices are affected by XSS. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.…
-
Medium 6.7
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.67,…
-
Medium 6.2
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R6250 before V1.0.4.8, R6400 …