Archive
13 May 2020
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of i…
-
Unscored —
In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module alloca…
-
Unscored —
In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, …
-
Unscored —
In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local us…
-
Unscored —
In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.…
-
Unscored —
In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.…
-
Unscored —
Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal use…
-
Unscored —
Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authen…
-
Unscored —
Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compat…
-
Medium 6.5
Persistent XSS in markdown parser used by obs-server
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9d…
-
Unscored —
TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java obje…
-
Unscored —
The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF…
-
Unscored —
TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack-based buffer overflow …
-
Unscored —
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
-
Medium 4.3
Missing Authorization in TYPO3 extension
The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
-
Medium 6.1
Open redirect in direct_mail
The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
-
Medium 4.3
Missing Authorization in TYPO3 extension
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
-
Medium 5.3
Denial of service in direct_mail
The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
-
Unscored —
Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can b…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensiti…
-
High 7.5
ClamAV ARJ Archive Parsing Denial of Service Vulnerability
A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer over…
-
High 7.5
ClamAV PDF Parsing Denial of Service Vulnerability
A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack bu…
-
Low 2.3CVE-2020-11932 Public exploit
Subiquity server installer logged LUKS full disk encryption password
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.