Archive
20 May 2020
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Medium 5.3
Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, r…
-
Medium 5.3
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by de…
-
High 7.8
Microweber allows Unrestricted File Upload
Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
-
Unscored —
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet rec…
-
High 7.0
Potential remote code execution in Apache Tomcat
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…
-
High 7.5
Denial of Service in Gitea
An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.
-
Medium 6.8
CRLF injection in httplib2
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with u…
-
Unscored —
The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all …
-
Medium 5.4
Dolibarr Stored Cross-site Scripting via file upload
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
-
Medium 5.4
Dolibarr Stored Cross-site Scripting
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
-
Unscored —
In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.
-
Unscored —
CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database serve…
-
Unscored —
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that accoun…
-
Unscored —
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's …
-
Unscored —
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.…
-
High 7.7
A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vho…
-
Unscored —
Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions. NOTE: th…
-
Medium 6.0
A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-u…
-
Unscored —CVE-2020-12835 EPSS 13%
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an u…
-
Medium 6.5
IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token…
-
Unscored —CVE-2020-13152 Public exploit
A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will tr…
-
Critical 9.8
TIBCO JasperReports Server Fails To Enforce Access Restrictions
The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated atta…
-
High 7.3
TIBCO JasperReports Library
The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix …
-
Critical 9.8
WSO2 API Manager vulnerable to SSRF
WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.
-
Unscored —
SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights t…
-
Unscored —
Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vect…
-
Medium 5.3
Temporary files are not cleaned after OOM when parsing HTTP request data
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop p…
-
Unscored —
phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the U…
-
Unscored —
Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterpri…
-
Unscored —
Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.