Archive
May 2020
Vulnerabilities first published in this month (UTC), newest first.
1,032 results · Feed
-
Unscored —
UliCMS before 2020.2 has XSS during PackageController uninstall.
-
Unscored —CVE-2020-12704 Public exploit
UliCMS before 2020.2 has PageController stored XSS.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.
-
Unscored —CVE-2020-12706 Public exploit
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web scri…
-
Unscored —CVE-2020-12707 Public exploit
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only secu…
-
Unscored —
Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web scri…
-
High 7.8
Dext5 Upload ActiveX Arbitrary File Execution Vulnerability
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, …
-
Unscored —
An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will resu…
-
Unscored —
An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source …
-
Unscored —CVE-2020-10973 Scanner template
An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/E…
-
High 7.8
Zoneplayer ActiveX File Download Vulnerability
IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution.
-
Unscored —
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of th…
-
Unscored —
An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This …
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 befo…
-
Critical 9.8
curlrequest allows execution of arbitrary commands
curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.
-
Unscored —
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Mon…
-
Unscored —
GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.
-
Unscored —
Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross…
-
Unscored —
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-s…
-
Unscored —
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-s…
-
Unscored —
Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross…
-
Unscored —
Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricki…
-
Unscored —
The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remo…
-
Unscored —
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-s…
-
Unscored —
Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metada…
-
Unscored —
Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary file…
-
Unscored —
Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-s…
-
Unscored —
Katyshop2 before 2.12 has multiple stored XSS issues.
-
High 8.8
Command injection via specially crafted file name during config file upload
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading th…
-
High 7.8
Incorrect privilege assignment allowing non-admin users to upload config files
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the sys…
-
Unscored —
An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin au…
-
Unscored —
An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, i…
-
Unscored —
An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones…
-
Unscored —
In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most…
-
Unscored —
Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /defa…
-
Unscored —
A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenti…
-
Unscored —
A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authent…
-
Unscored —
Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwor…
-
Unscored —
Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 all…
-
Unscored —
/server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain…