Archive
29 April 2020
Vulnerabilities first published on this day (UTC), newest first.
83 results · Feed
-
Unscored —
Accellion File Transfer Appliance Improper Neutralization of Special Elements used in a Command ('Command Injection')
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').
-
Unscored —
Accellion File Transfer Appliance Use of Hard-coded Credentials
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.
-
Unscored —
ABBS Software Audio Media Player Stack-based Buffer Overflow
ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
Unscored —
ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function
ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.
-
Unscored —CVE-2019-5619 Public exploit
AASync.com AASync Stack-based Buffer Overflow
AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
Unscored —CVE-2019-5618 Public exploit
A-PDF WAV to MP3 Stack-based Buffer Overflow
A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
High 7.5
Incorrect Authorization in TeamPass
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.
-
High 7.5CVE-2020-12478 Scanner template
TeamPass files are available without authentication
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
-
High 8.8
TeamPass PHP arbitrary file include vulnerability
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal.
-
Unscored —
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices …
-
Unscored —CVE-2020-11943 EPSS 24%
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.
-
Unscored —
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.
-
Medium 6.1
Man-in-the-middle attack in Moonlight iOS/tvOS
In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.0.1 for iOS and tvOS.
-
High 7.8
Cisco IOS XE SD-WAN Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit t…
-
Medium 6.5
Session Fixation in Subrion CMS
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
-
High 7.8
Subrion CMS CSV injection via Export Language
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.
-
Medium 6.5
Subrion CMS PHP Object Injection
admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.
-
Unscored —
MonoX through 5.1.40.5152 allows administrators to execute arbitrary code by modifying an ASPX template.
-
Unscored —
MonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages/SocialNetworking/lng/en-US/PhotoGa…
-
Unscored —
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description.
-
Unscored —
MonoX through 5.1.40.5152 allows admins to execute arbitrary programs by reconfiguring the Converter Executable setting…
-
Unscored —
An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel b…
-
Medium 6.3
HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client
Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an…
-
Unscored —
usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer oc…
-
High 8.5
Authentication and extension bypass in Faye
Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending e…
-
Medium 6.5
IDOR can reveal execution data and logs to unauthorized user in Rundeck
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything b…
-
Unscored —
GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snip…
-
Unscored —
GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.
-
Unscored —
GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not acti…
-
Unscored —
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
-
Unscored —
PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can …
-
Medium 5.5
Grafana information disclosure
An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted dat…
-
Medium 5.5
Grafana world readable configuration files
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
-
Unscored —
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
-
High 7.2
AxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote files to be downloaded an…
-
Medium 6.4
ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary…
-
High 7.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Unscored —
The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability.
-
Unscored —
Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID…
-
Unscored —
Cerner medico 26.00 has a Local Buffer Overflow (issue 3 of 3).