Archive
April 2020
Vulnerabilities first published in this month (UTC), newest first.
592 results · Clear filters · Feed
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R670…
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 5.7
Command execution due to unsanitized input in Netatmo Smart Indoor Security Camera
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Camera allows an attacker to execute commands on the device. This issue affects: Netatmo Smart Indoor …
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.8
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
-
Medium 6.3
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.6…
-
Medium 5.2
Certain NETGEAR devices are affected by stored XSS. This affects R6400 before 1.0.1.14, R6700 before 1.0.1.22, R6900 be…
-
Medium 6.1
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects EX3700 before 1.0.0.…
-
Medium 4.2
Prototype pollution in paypal-adaptive
paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
-
Medium 4.6
IBM MaaS360 6.82 could allow a user with pysical access to the device to crash the application which may enable the use…
-
Medium 5.0
IBM UrbanCode Deploy (UCD) 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the ser…
-
Medium 6.2
IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IB…
-
Medium 6.3
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.
-
Medium 5.8
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This fla…
-
Medium 6.1CVE-2020-7350 Public exploit
Metasploit Framework Plugin Libnotify Command Injection
Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially…
-
Medium 6.5
World writable root owned lock file created in user controllable location
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply cont…
-
Medium 5.6
Apport race condition in crash report permissions
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when t…
-
Medium 5.3
Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hand…
-
Medium 6.8
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D7800 before 1.0.1.34,…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 befo…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WNDR3700v4 before 1.0.…
-
Medium 4.7
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.3…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8300 befo…
-
Medium 6.8
NETGEAR R8000 devices before 1.0.4.2 are affected by a stack-based buffer overflow by an authenticated user.
-
Medium 6.5
Certain NETGEAR devices are affected by denial of service. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.22, …
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34,…
-
Medium 6.5
Certain NETGEAR devices are affected by denial of service. This affects GS110EMX before 1.0.0.9, GS810EMX before 1.0.0.…
-
Medium 5.4
Cross-site scripting in lazysizes
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
-
Medium 5.2
Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 5.0.5.4 …
-
Medium 4.6
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D6220 before 1.0.0.…
-
Medium 6.8
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R7800 before 1.0.2.36,…
-
Medium 6.7
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before V1.0.0.55…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44,…