Archive
9 June 2020
Vulnerabilities first published on this day (UTC), newest first.
20 results · Clear filters · Feed
-
Medium 6.1
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 whic…
-
Medium 6.4
Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmwa…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStati…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo No…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkS…
-
Medium 6.4
An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.
-
Medium 6.7
A symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3, could allow privileged fi…
-
Medium 6.7
A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 4.3CVE-2020-9819 Exploited
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5…
KEV Nov 3, 2021 -
Medium 4.3
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update perm…
-
Medium 4.8
OpenCart Cross-site Scripting
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor state…
-
Medium 5.0
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. Th…
-
Medium 6.1CVE-2020-13973 Public exploit
Cross-site scripting in json-sanitizer
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where…
-
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024