Archive
May 2020
Vulnerabilities first published in this month (UTC), newest first.
1,032 results · Feed
-
Low 2.2
Improper Validation of Array Index in FreeRDP
In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound o…
-
Critical 9.8
bbPress unauthenticated privilege-escalation
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
-
Medium 6.4
Cross-Site Scripting in Kaminari
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
-
Unscored —
Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent f…
-
Critical 9.8
Drupal core - Critical - Access bypass - SA-CORE-2019-008
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
-
High 7.1
Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File …
-
Unscored —
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
-
High 8.6
command injection fix in node-dns-sync
node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.
-
Unscored —
Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1…
-
Medium 5.3
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN th…
-
Medium 5.3
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN th…
-
Low 2.7
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information w…
-
Medium 5.4
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows use…
-
Medium 6.5
IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authentica…
-
High 7.1
IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack …
-
Medium 5.9
IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by def…
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive informatio…
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid lo…
-
Low 3.7
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, …
-
Medium 4.3
IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized comma…
-
Unscored —
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queu…
-
Unscored —
parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated …
-
Unscored —
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which…
-
High 7.8
Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability
Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by re…
-
Unscored —
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting i…
-
Unscored —
VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated use…
-
Unscored —
testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XX…
-
Unscored —
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the …
-
High 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content …
-
High 8.8
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did…
-
Medium 5.4
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_aja…
-
High 8.8
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page funct…
-
Unscored —
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authen…
-
Unscored —
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbit…
-
Unscored —
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sens…
-
Unscored —
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remo…
-
High 7.7
Shell Escape in Anchore Engine
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only b…
-
Critical 9.6
Exposure of Sensitive Information to an Unauthorized Actor in AEgir
In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.
-
Unscored —
-
Critical 9.3
Kiosk Mode Breakout in Bosch Recording Station
Improper Access Control in the Kiosk Mode functionality of Bosch Recording Station allows a local unauthenticated attacker to escape from the Kiosk Mode and access the underlying operating system.