Archive
23 April 2020
Vulnerabilities first published on this day (UTC), newest first.
93 results · Feed
-
High 7.1CVE-2019-15794 Public exploit
Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for t…
-
Medium 6.5CVE-2019-15793 Public exploit
Mishandling of file-system uid/gid with namespaces in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whe…
-
High 7.1CVE-2019-15792 Public exploit
Type confusion in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->pri…
-
High 7.1CVE-2019-15791 Public exploit
Reference count underflow in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the …
-
Unscored —
Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.
-
Unscored —
The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.
-
Unscored —
The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.
-
Unscored —
The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).
-
Unscored —
DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.
-
Critical 9.3
Authentication bypass MinIO Admin API
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without know…
-
Medium 4.5
Certain NETGEAR devices are affected by denial of service. This affects R6100 before 1.0.1.22, R7500 before 1.0.0.122, …
-
High 8.0
NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.
-
High 8.6
Incorrect Default Permissions in Binance tss-lib
The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.
-
Medium 4.5
Certain NETGEAR devices are affected by denial of service. This affects R6100 before 1.0.1.22, R7500 before 1.0.0.122, …
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.64 …
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects DGN2200Bv4…
-
High 8.8
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6400 before 1.0…
-
High 8.8
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.3…
-
Medium 4.5
Certain NETGEAR devices are affected by denial of service. This affects R6100 before 1.0.1.22, R7500 before 1.0.0.122, …
-
High 7.1
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D1500 before 1.0.0.27, D500 b…
-
High 8.8
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.7…
-
High 8.8
Certain NETGEAR devices are affected by a hardcoded password. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0…
-
Medium 4.6
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D3600 before 1.0.0.76 and D60…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R670…
-
Unscored —
In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to chec…
-
High 8.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects WAC5…
-
High 8.8
Certain NETGEAR devices are affected by authentication bypass. This affects WAC505 before 5.0.0.17 and WAC510 before 5.…
-
High 8.1
Certain NETGEAR devices are affected by unauthenticated firmware downgrade. This affects WAC505 before 5.0.0.17 and WAC…
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Unscored —
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to c…
-
Medium 5.7
Command execution due to unsanitized input in Netatmo Smart Indoor Security Camera
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Camera allows an attacker to execute commands on the device. This issue affects: Netatmo Smart Indoor …
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Unscored —
In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TL…
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.