Archive
May 2020
Vulnerabilities first published in this month (UTC), newest first.
66 results · Clear filters · Feed
-
Critical 9.8
XML External Entity attack in log4net
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
-
Unscored —CVE-2020-12753 Public exploit
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code executio…
-
Unscored —
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abu…
-
Unscored —
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnod…
-
Unscored —
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in…
-
High 7.8CVE-2018-20225 Public exploit
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if …
-
High 7.2
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute ar…
KEV Mar 10, 2023 -
Unscored —
vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
-
Critical 9.1
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary c…
KEV Nov 3, 2021 -
Critical 10.0
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrati…
-
Critical 9.0
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…
KEV Nov 3, 2021 -
Unscored —
Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attac…
-
Unscored —CVE-2020-12704 Public exploit
UliCMS before 2020.2 has PageController stored XSS.
-
Unscored —CVE-2020-12706 Public exploit
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web scri…
-
Unscored —CVE-2020-12707 Public exploit
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only secu…
-
Unscored —
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Mon…
-
Unscored —
In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most…
-
Unscored —CVE-2020-12696 Public exploit
The iframe plugin before 4.5 for WordPress does not sanitize a URL.
-
Critical 9.1
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and dele…
-
Unscored —CVE-2020-6861 Public exploit
A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local atta…
-
Unscored —
Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220…
-
Unscored —CVE-2020-12640 Public exploit
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a pl…
-
Critical 9.8
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…
KEV Jun 22, 2023 -
Unscored —CVE-2020-12629 Public exploit
include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
-
Unscored —CVE-2020-12625 Public exploit
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube…
-
High 7.3
Fonality Trixbox CE Post-Authentication Command Injection
An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been …