Archive
May 2020
Vulnerabilities first published in this month (UTC), newest first.
1,032 results · Feed
-
Unscored —
This module enables you to force a password update when using password reset link. The module doesn't sufficiently vali…
-
Unscored —
Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit ord…
-
Unscored —
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetI…
-
Unscored —
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetI…
-
Unscored —
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page pa…
-
Medium 4.3
Centreon Sensitive Data Exposure vulnerability
Centreon before 19.10.7 exposes Session IDs in server responses.
-
Medium 6.1
Fork CMS Cross-site Scripting Vulnerability
Fork before 5.8.3 allows XSS via navigation_title or title.
-
Unscored —
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
-
Unscored —
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c a…
-
Unscored —
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
-
Unscored —
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_w…
-
Medium 5.9
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attac…
-
Medium 4.9
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions …
-
Medium 5.4
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to em…
-
Medium 5.9
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attac…
-
Medium 4.3
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detaile…
-
Medium 5.9
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attac…
-
Medium 6.5
IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perfor…
-
Medium 5.9
IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to inf…
-
High 8.2
In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the Sma…
-
Unscored —
An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in…
-
Medium 6.3
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 w…
-
Unscored —
JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a …
-
Unscored —
JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.
-
Unscored —
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
-
Unscored —
lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.
-
Unscored —
The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
-
High 8.8
Kantech EntraPass Security Management Software - System Permissions Vulnerability
A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files.
-
Unscored —
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridgi…
-
Unscored —
A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corrupti…
-
Unscored —
A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a po…
-
Unscored —
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Not…
-
Unscored —
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Not…
-
Unscored —
Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability …
-
Unscored —
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed …
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can …
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be …
-
Unscored —
A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by se…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some o…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed e…