Archive
April 2020
Vulnerabilities first published in this month (UTC), newest first.
75 results · Clear filters · Feed
-
Unscored —
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
-
Medium 6.5
SaltStack Salt is vulnerable Arbitrary Directory Access
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
KEV Nov 3, 2021 -
Critical 9.8
SaltStack Salt Unauthenticated Remote Code Execution
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…
KEV Nov 3, 2021 -
Unscored —
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
-
Medium 6.1
Password reset links invalidation issue in WordPress
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version…
-
Unscored —
ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function
ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.
-
Unscored —CVE-2019-5619 Public exploit
AASync.com AASync Stack-based Buffer Overflow
AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
Unscored —CVE-2019-5618 Public exploit
A-PDF WAV to MP3 Stack-based Buffer Overflow
A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
Unscored —CVE-2020-12446 Public exploit
The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical mem…
-
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Medium 6.9
jQuery has a potential XSS vulnerability
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…
-
Unscored —CVE-2020-12261 Public exploit
Open-AudIT 3.3.0 allows an XSS attack after login.
-
High 7.5CVE-2020-10663 Public exploit
Unsafe object creation in json RubyGem
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…
-
Unscored —CVE-2020-12078 Public exploit
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/con…
-
Unscored —
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 a…
-
Low 3.7CVE-2020-9488 Public exploit
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.…
-
Unscored —CVE-2020-12242 Public exploit
Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in…
-
High 7.1CVE-2019-15794 Public exploit
Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for t…
-
Medium 6.5CVE-2019-15793 Public exploit
Mishandling of file-system uid/gid with namespaces in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whe…
-
High 7.1CVE-2019-15792 Public exploit
Type confusion in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->pri…
-
High 7.1CVE-2019-15791 Public exploit
Reference count underflow in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the …
-
Unscored —CVE-2020-12112 Public exploit
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
-
Unscored —CVE-2020-12077 Public exploit
The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions w…
-
Medium 6.1CVE-2020-7350 Public exploit
Metasploit Framework Plugin Libnotify Command Injection
Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…
-
Unscored —CVE-2020-11539 Public exploit
An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pa…
-
Unscored —CVE-2019-17525 Public exploit
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism an…
-
Unscored —CVE-2020-11890 Public exploit
An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to…
-
High 7.5
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…
-
Medium 5.3
Diavante vue-storefront-api and storefront-api disclose stack trace
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.
-
Unscored —CVE-2020-0082 Public exploit
In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe des…
-
Unscored —CVE-2019-6203 Public exploit
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS…
-
Unscored —
In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achiev…
-
Critical 9.8
Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vuln…
-
Critical 9.8
Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vuln…
-
Critical 9.8
Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to…
KEV Nov 3, 2021 -
Unscored —CVE-2020-0568 Public exploit
Race condition in the Intel(R) Driver and Support Assistant before version 20.1.5 may allow an authenticated user to po…
-
Unscored —CVE-2020-0557 Public exploit
Insecure inherited permissions in Intel(R) PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow a…
-
High 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021