Archive
1 June 2020
Vulnerabilities first published on this day (UTC), newest first.
38 results · Feed
-
Medium 6.3
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elev…
-
Unscored —
An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin conso…
-
Unscored —
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20…
-
High 7.5
Python-RSA decryption of ciphertext leads to DoS
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affect…
-
Unscored —
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges …
-
Unscored —
system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers…
-
Unscored —
FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx…
-
Unscored —
FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php.
-
Unscored —
FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature.
-
Unscored —
Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= …
-
Unscored —
Lexiglot through 2014-11-20 allows CSRF.
-
Unscored —
Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.
-
Unscored —
Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config inst…
-
Unscored —
Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a g…
-
Unscored —
Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the usernam…
-
Unscored —
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/p…
-
Unscored —
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by …
-
Unscored —
admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.
-
Unscored —
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, wh…
-
Unscored —
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mys…
-
Unscored —
QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execu…
-
High 8.1
Insecure serialization leading to RCE in serialize-javascript
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
-
Unscored —
There is a few bytes out-of-bounds read vulnerability in some Huawei products. The software reads data past the end of …
-
Unscored —
A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected t…
-
Unscored —
p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment.
-
Critical 10.0
GESIO SQL injection vulnerability
There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.
-
High 7.5
HTTP Request Smuggling in reel
reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encodi…
-
Unscored —
There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connect…
-
Unscored —
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject a…
-
Unscored —
Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote …
-
Unscored —
The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who con…
-
Unscored —
The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setu…
-
Unscored —
The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the a…
-
Unscored —
The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attacker…
-
Unscored —
The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible be…
-
Unscored —
The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before v…
-
Unscored —
The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to …
-
Unscored —
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary …