Archive
27 April 2020
Vulnerabilities first published on this day (UTC), newest first.
86 results · Feed
-
Low 2.8
Apport reads PID files with elevated privileges
Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit thi…
-
Critical 9.8
OS Command Injection in pixl-class
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
-
Unscored —
Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.
-
Critical 9.8
Code Injection in node-rules
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
-
Medium 5.3
A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) t…
-
High 7.0
Insufficient Session Expiration in Kiali
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gai…
-
High 7.5
OOB Read in urldecode()
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array i…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 befo…
-
Unscored —
There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-S…
-
Unscored —
There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-S…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
Unscored —
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7500 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
High 8.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects EX27…
-
High 8.8
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7000 before 2018-03…
-
Medium 6.5
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D7000 before 1.0.1.52, D7800 …
-
Medium 4.8
Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.57, DM200 before 1.0.0.50, EX2700 b…
-
Medium 4.5
NETGEAR ReadyNAS devices before 6.9.3 are affected by incorrect configuration of security settings.
-
High 8.8
NETGEAR R7800 devices before 1.0.2.46 are affected by incorrect configuration of security settings.
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.28,…
-
Medium 6.8
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D6220 before 1.0.0.38,…
-
Medium 6.3
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.52, R6100 be…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34,…
-
High 8.8
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D7800 before 1.0…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34,…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 befo…
-
High 7.6
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
High 7.6
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Unscored —
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.
-
Unscored —
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 a…
-
Critical 9.8
Improper Certificate Validation in Apache IoTDB
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
-
Unscored —
SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allo…