Archive
May 2020
Vulnerabilities first published in this month (UTC), newest first.
1,032 results · Feed
-
Unscored —
Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass…
-
Unscored —
Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof secur…
-
Unscored —
Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof s…
-
Unscored —
Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to pe…
-
Unscored —
Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof secur…
-
Unscored —
Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a…
-
Unscored —
Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain pot…
-
Unscored —
Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap co…
-
Unscored —
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convi…
-
Unscored —
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convi…
-
Unscored —CVE-2020-6468 Public exploit
Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corru…
-
Unscored —
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convi…
-
Unscored —
Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker…
-
Unscored —
Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the render…
-
Unscored —
Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compr…
-
Unscored —
Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised…
-
Unscored —
Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the ren…
-
Unscored —
Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to per…
-
Unscored —
Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit hea…
-
Unscored —
Out of bounds read and write in PDFium in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially…
-
Unscored —
Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially pe…
-
High 8.8
Command Injection in Centreon
Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
-
Unscored —
Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequence…
-
Medium 5.3
Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, r…
-
Medium 5.3
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by de…
-
High 7.8
Microweber allows Unrestricted File Upload
Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
-
Unscored —
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet rec…
-
High 7.0
Potential remote code execution in Apache Tomcat
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…
-
High 7.5
Denial of Service in Gitea
An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.
-
Medium 6.8
CRLF injection in httplib2
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with u…
-
Unscored —
The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all …
-
Medium 5.4
Dolibarr Stored Cross-site Scripting via file upload
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
-
Medium 5.4
Dolibarr Stored Cross-site Scripting
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
-
Unscored —
In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.
-
Unscored —
CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database serve…
-
Unscored —
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that accoun…
-
Unscored —
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's …