Archive
9 June 2020
Vulnerabilities first published on this day (UTC), newest first.
222 results · Feed
-
Unscored —
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, tv…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. Inserting a USB …
-
Unscored —CVE-2020-9801 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.1. A malicious process may c…
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, mac…
-
Unscored —
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.5 and iPadOS 13.5, …
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, ma…
-
Unscored —
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.5 and iPad…
-
Unscored —
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.5 and iPadOS 13.5, mac…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.5. Importing a maliciously c…
-
Medium 4.3
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update perm…
-
Medium 4.8
OpenCart Cross-site Scripting
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor state…
-
Unscored —
An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary comma…
-
Unscored —
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration …
-
Unscored —
Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chun…
-
Unscored —CVE-2020-10757 Public exploit
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allo…
-
Medium 5.0
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. Th…
-
Unscored —
SONY Wireless Headphones WF-1000X, WF-SP700N, WH-1000XM2, WH-1000XM3, WH-CH700N, WH-H900N, WH-XB700, WH-XB900N, WI-1000…
-
Unscored —
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…
-
Medium 6.1CVE-2020-13973 Public exploit
Cross-site scripting in json-sanitizer
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where…
-
Unscored —
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allow…
-
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024