Archive
April 2020
Vulnerabilities first published in this month (UTC), newest first.
2,191 results · Feed
-
Medium 5.2
Path Traversal in Ansible
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could tak…
-
Unscored —
SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privil…
-
Unscored —
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
-
Unscored —
The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's s…
-
Unscored —
A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Con…
-
Unscored —
BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.
-
Unscored —
BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.
-
Unscored —
BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.
-
Unscored —
BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download.
-
Unscored —
BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).
-
Unscored —
Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.…
-
Unscored —
In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for ac…
-
Medium 6.1
Open redirect vulnerability in Sourcegraph
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
-
Medium 6.1
Password reset links invalidation issue in WordPress
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version…
-
High 7.0
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was c…
-
Unscored —
Accellion File Transfer Appliance Improper Neutralization of Special Elements used in a Command ('Command Injection')
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').
-
Unscored —
Accellion File Transfer Appliance Use of Hard-coded Credentials
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.
-
Unscored —
ABBS Software Audio Media Player Stack-based Buffer Overflow
ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
Unscored —
ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function
ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.
-
Unscored —CVE-2019-5619 Public exploit
AASync.com AASync Stack-based Buffer Overflow
AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
Unscored —CVE-2019-5618 Public exploit
A-PDF WAV to MP3 Stack-based Buffer Overflow
A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
-
High 7.5
Incorrect Authorization in TeamPass
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.
-
High 7.5CVE-2020-12478 Scanner template
TeamPass files are available without authentication
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
-
High 8.8
TeamPass PHP arbitrary file include vulnerability
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal.
-
Unscored —
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices …
-
Unscored —CVE-2020-11943 EPSS 24%
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.
-
Unscored —
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.
-
Medium 6.1
Man-in-the-middle attack in Moonlight iOS/tvOS
In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.0.1 for iOS and tvOS.
-
High 7.8
Cisco IOS XE SD-WAN Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit t…
-
Medium 6.5
Session Fixation in Subrion CMS
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
-
High 7.8
Subrion CMS CSV injection via Export Language
Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.
-
Medium 6.5
Subrion CMS PHP Object Injection
admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.
-
Unscored —
MonoX through 5.1.40.5152 allows administrators to execute arbitrary code by modifying an ASPX template.
-
Unscored —
MonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages/SocialNetworking/lng/en-US/PhotoGa…
-
Unscored —
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description.
-
Unscored —
MonoX through 5.1.40.5152 allows admins to execute arbitrary programs by reconfiguring the Converter Executable setting…
-
Unscored —
An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel b…
-
Medium 6.3
HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client
Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an…
-
Unscored —
usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer oc…
-
High 8.5
Authentication and extension bypass in Faye
Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending e…