Archive
28 May 2020
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Critical 9.8
bbPress unauthenticated privilege-escalation
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
-
Medium 6.4
Cross-Site Scripting in Kaminari
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
-
Unscored —
Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent f…
-
Critical 9.8
Drupal core - Critical - Access bypass - SA-CORE-2019-008
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
-
High 7.1
Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File …
-
Unscored —
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
-
High 8.6
command injection fix in node-dns-sync
node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.
-
Unscored —
Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1…
-
Medium 5.3
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN th…
-
Medium 5.3
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN th…
-
Low 2.7
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information w…
-
Medium 5.4
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows use…
-
Medium 6.5
IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authentica…
-
High 7.1
IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack …
-
Medium 5.9
IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by def…
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive informatio…
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid lo…
-
Low 3.7
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, …
-
Medium 4.3
IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized comma…
-
Unscored —
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queu…
-
Unscored —
parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated …
-
Unscored —
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which…
-
High 7.8
Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability
Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by re…
-
Unscored —
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting i…
-
Unscored —
VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated use…
-
Unscored —
testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XX…
-
Unscored —
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the …
-
High 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content …
-
High 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did…
-
Medium 5.4
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_aja…
-
High 8.8
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page funct…