Archive
April 2020
Vulnerabilities first published in this month (UTC), newest first.
75 results · Clear filters · Feed
-
Unscored —CVE-2020-1015 Public exploit
An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in me…
-
Unscored —CVE-2020-0910 Public exploit
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input fro…
-
Critical 9.8
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…
-
High 8.8CVE-2020-2944 Public exploit
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versio…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Jan 7, 2025 -
Critical 9.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics…
-
Critical 9.3
malicious URLs may cause Git to present stored credentials to the wrong server
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure stor…
-
Unscored —CVE-2019-14326 Public exploit
An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23)…
-
Unscored —CVE-2020-9461 Public exploit
Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateF…
-
Unscored —CVE-2020-9460 Public exploit
Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vul…
-
High 7.5
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Trave…
KEV Nov 3, 2021 -
High 8.1
Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22…
-
Critical 9.8
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Serv…
KEV Nov 3, 2021 -
Unscored —CVE-2020-10551 Public exploit
QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to t…
-
Unscored —CVE-2020-11650 Public exploit
An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a den…
-
Unscored —
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
-
High 8.8
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attack…
KEV Nov 3, 2021 -
Unscored —CVE-2020-11560 Public exploit
NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.
-
Unscored —
There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers m…
-
Unscored —CVE-2020-8004 Public exploit
STMicroelectronics STM32F1 devices have Incorrect Access Control.
-
Unscored —
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes run…
-
Unscored —
An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute a…
-
Unscored —CVE-2020-8637 Public exploit
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenode…
-
High 7.8CVE-2020-8835 Public exploit
Linux kernel bpf verifier vulnerability
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable …
-
Unscored —
An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivilege…
-
Unscored —CVE-2020-11444 Public exploit
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
-
Unscored —CVE-2020-8423 Public exploit
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticate…
-
Unscored —CVE-2020-11491 Public exploit
Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal atta…
-
Medium 6.5CVE-2020-1958 Public exploit
Credentials bypass in Apache Druid
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. Th…
-
Medium —
Deserialization of Untrusted Data in Apache Dubbo
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue af…
-
High 8.8
Nexus Repository Manager 3 - Remote Code Execution
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
KEV Nov 3, 2021 -
High 8.8
Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
-
Unscored —
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFile…
-
Unscored —
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and applicat…
-
Unscored —CVE-2020-11457 Public exploit
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full …