Archive
May 2020
Vulnerabilities first published in this month (UTC), newest first.
1,032 results · Feed
-
Unscored —
In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. This coul…
-
Unscored —
In onShowingStateChanged of KeyguardStateMonitor.java, there is a possible inappropriate read due to a logic error. Thi…
-
Unscored —
In navigateUpToLocked of ActivityStack.java, there is a possible permission bypass due to a confused deputy. This could…
-
Unscored —
In onKeyguardVisibilityChanged of key_store_service.cpp, there is a missing permission check. This could lead to local …
-
Unscored —
In GattServer::SendResponse of gatt_server.cc, there is a possible out of bounds write due to an incorrect bounds check…
-
Unscored —
In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions by…
-
Medium 6.5
Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication…
-
Medium 6.3
Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain u…
-
High 7.5
Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication.
-
Medium 5.3
Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server. This vulne…
-
Unscored —
An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately …
-
Medium 6.5
Dictionary attack with Spring Security queryable text encryptor
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious…
-
Medium 6.1
Apache ActiveMQ webconsole admin GUI is open to XSS
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
-
Critical 9.8
Deserialization of Untrusted Data in Apache Camel RabbitMQ
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
-
Critical 9.8
Apache Camel Netty enables Java deserialization by default
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
-
Unscored —
An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RA…
-
High 7.5CVE-2020-11971 EPSS 14%
Improper Input Validation in Apache Camel
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
-
Unscored —
Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algori…
-
Unscored —
The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem…
-
Unscored —
A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all ver…
-
Medium —CVE-2019-17572 Public exploit
Directory traversal in Apache RocketMQ
In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in broker…
-
Medium 4.7
Command injection in Apache Flink
A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port con…
-
Medium 6.3
Sensitive Data Exposure in Apache Ant
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the te…
-
Unscored —
In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malic…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused…
-
Medium 5.3
IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted reque…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user throu…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused…
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused …
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused …
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused …
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused …
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused …
-
High 7.8
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused …
-
Medium 6.5
IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information…