Archive
22 May 2020
Vulnerabilities first published on this day (UTC), newest first.
32 results · Feed
-
Unscored —
An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token…
-
Unscored —
An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API…
-
Unscored —
An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software.
-
Unscored —
An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identit…
-
Unscored —
An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is n…
-
Unscored —
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for C…
-
Unscored —
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address …
-
Critical 9.8
OS Command Injection in jw.util
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command e…
-
Unscored —
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.4…
-
Unscored —
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.4…
-
Unscored —
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.4…
-
Unscored —
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.4…
-
Unscored —
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.4…
-
Unscored —
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.4…
-
Medium 6.1
meinheld vulnerable to HTTP Request Smuggling
meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.
-
Medium 6.8
HTTP Smuggling via Transfer-Encoding Header in Puma
In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelini…
-
High 7.5CVE-2020-11076 Public exploit
HTTP Smuggling via Transfer-Encoding Header in Puma
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
-
Medium 5.9
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occ…
-
Critical 9.8
An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAI…
-
High 8.8
Command Injection in Kylin
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
KEV Mar 25, 2022 -
Unscored —
Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration.
-
High 7.8
Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability
Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execute arbitrary file by setting the arguments to the activex method. This can be leveraged for code exe…
-
Critical 9.8
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to insecure deserialization…
-
Medium 6.7
Cisco Prime Collaboration Provisioning Software SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based manag…
-
High 7.5
Cisco Prime Network Registrar DHCP Denial of Service Vulnerability
A vulnerability in the DHCP server of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of incoming DHCP …
-
Medium 6.1
Cisco AMP for Endpoints Mac Connector Software File Scan Denial of Service Vulnerability
A vulnerability in the file scan process of Cisco AMP for Endpoints Mac Connector Software could cause the scan engine to crash during the scan of local files, resulting in a restart of the AMP Connector and a denial of service (DoS) condition of the Cisco AM…
-
Medium 5.5
Cisco AMP for Endpoints Linux Connector and AMP for Endpoints Mac Connector Software Memory Buffer Vulnerability
A vulnerability in Cisco AMP for Endpoints Linux Connector Software and Cisco AMP for Endpoints Mac Connector Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient inpu…
-
Medium 5.5
Cisco AMP for Endpoints Linux Connector and AMP for Endpoints Mac Connector Software Memory Buffer Vulnerability
A vulnerability in Cisco AMP for Endpoints Linux Connector Software and Cisco AMP for Endpoints Mac Connector Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient inpu…
-
Unscored —
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=fil…
-
Unscored —
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_re…
-
Unscored —CVE-2020-13398 Public exploit
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto…
-
Unscored —
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in securit…