Archive
19 May 2020
Vulnerabilities first published on this day (UTC), newest first.
36 results · Feed
-
Unscored —
Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that coul…
-
Unscored —
Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exp…
-
Unscored —
A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. Apply HPE Superdome Fl…
-
Unscored —
Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterpri…
-
Unscored —
In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in…
-
High 7.4
Improper certificate validation in em-imap
em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
-
High 8.8
Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file
Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM im…
-
Medium 6.5
Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host
An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resu…
-
Unscored —
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardco…
-
Unscored —
Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certai…
-
Unscored —
sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Comman…
-
Medium 5.1
A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_l…
-
Medium 5.1
A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on t…
-
Medium 5.1
A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for us…
-
Unscored —
Panasonic P99 devices through 2020-04-10 have Incorrect Access Control. NOTE: the vendor states that all affected produ…
-
Unscored —
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An i…
-
Unscored —
Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated use…
-
Unscored —CVE-2020-10030 EPSS 24%
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privil…
-
Medium 5.4CVE-2020-10135 Public exploit
Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent att…
-
Medium 6.3
Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks
Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user errone…
-
Medium 5.3
unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.
-
High 7.5
Improper Input Validation in RESTEasy
A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may res…
-
Unscored —
Cross Site Scripting vulnerability in Micro Focus Service Manager product. Affecting versions 9.50, 9.51, 9.52, 9.60, 9…
-
High 7.5
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key…
-
High 8.6CVE-2020-8616 EPSS 11%
BIND does not sufficiently limit the number of fetches performed when processing referrals
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches i…
-
Unscored —
An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN resp…
-
Unscored —
Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered …
-
Unscored —
Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.
-
Medium 5.3
The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial o…
-
High 7.1
The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial o…
-
Medium 5.4
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows…
-
Medium 4.3
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request forgery which could allow an…
-
Unscored —
PCS DEXICON 3.4.1 allows XSS via the loginName parameter in login_action.jsp.
-
Unscored —
Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch…
-
Medium 6.1CVE-2020-7656 Public exploit
Cross-Site Scripting in jquery
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
-
High 7.5
Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, ak…