Skip to content
OpenAdvisories

Archive

5 May 2020

Vulnerabilities first published on this day (UTC), newest first.

← April 2020 2020 / May /5 June 2020 →
  1. 16
  2. 23
  3. 31
  4. 449
  5. 539
  6. 679
  7. 777
  8. 837
  9. 914
  10. 102
  11. 1147
  12. 1247
  13. 1363
  14. 1470
  15. 1531
  16. 165
  17. 1710
  18. 1840
  19. 1936
  20. 2030
  21. 21168
  22. 2232
  23. 232
  24. 248
  25. 257
  26. 2627
  27. 2730
  28. 2831
  29. 2941
  30. 30 
  31. 31 
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.1
    CVE-2020-11034 Scanner template

    bypass of manageRedirect in GLPI

    In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.

    GLPI glpi glpi Ubuntu
  • Medium 5.3
    CVE-2020-12439

    Grin allows attackers to adversely affect availability of data on a Mimblewimble blockchain

    Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.

    grin crates.io
  • Medium 6.6
    CVE-2020-11033

    Able to read any token through API user endpoint in GLPI

    In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or r…

    GLPI glpi glpi Ubuntu
  • Medium 6.1
    CVE-2020-12666

    gopkg.in/macaron.v1 Open Redirect vulnerability

    macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

    gopkg.in/macaron.v1 Go
  • Medium 6.9
    CVE-2020-11051

    XSS in Wiki.js

    In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the M…

    requarks Wiki.js
  • Medium 4.8
    CVE-2020-12142

    IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials

    1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The…

    Silver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator,   3. EdgeConnect in AWS, Azure, GCP
  • Medium 6.0
    CVE-2020-12144

    The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated

    The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal.

    Silver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator,   3. EdgeConnect in AWS, Azure, GCP
  • Medium 6.0
    CVE-2020-12143

    The certificate used to identify Orchestrator to EdgeConnect devices is not validated

    The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.

    Silver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator,   3. EdgeConnect in AWS, Azure, GCP
  • Medium 6.8
    CVE-2017-18865

    Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8300 befo…

  • Medium 5.2
    CVE-2017-18866

    Certain NETGEAR devices are affected by stored XSS. This affects R9000 before 1.0.2.40, R6100 before 1.0.1.1, 6R7500 be…

  • Medium 6.8
    CVE-2017-18867

    Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6100 before 1.0.0.5…