Archive
10 June 2020
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
Unscored —
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack…
-
Unscored —
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_preparse in sdp.c has a NU…
-
Unscored —
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_process_incoming_request in ja…
-
Unscored —
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_process in sdp.c has a NUL…
-
High 8.6
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed…
-
High 7.1
Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability…
-
Unscored —
A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and belo…
-
Unscored —
Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauth…
-
High 7.7
Phar unserialization vulnerability in phpMussel
phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk …
-
High 7.5
Allocation of Resources Without Limits or Throttling in Undertow
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.
-
Critical 9.8
Improper Input Validation in HashiCorp Vault
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP c…
-
High 7.5
Information Disclosure in HashiCorp Vault
HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.
-
Unscored —
IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038eb7.
-
Unscored —
IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038ed4.
-
Medium 6.5
Liferay Portal and Liferay DXP Fails to Sanitize API Data
Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to…
-
High 8.8
Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code vi…
-
Unscored —
scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacke…
-
Low 3.8CVE-2020-2023 Public exploit
Kata Containers - Containers have access to the guest root filesystem device
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier…
-
Medium 5.3
GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie
When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manip…
-
High 7.0
GlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgrade
A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges. This issue can be exploited only while performing a GlobalProtect app upgrade. This issue affects: G…
-
High 7.2
PAN-OS: OS command injection vulnerability in management interface certificate generator
An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configurat…
-
High 7.2
PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification
An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PA…
-
High 7.2
PAN-OS: Buffer overflow in authd authentication response
A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 …
-
High 7.8
Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path
A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code executi…
-
Unscored —
The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) param…
-
Unscored —
In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to …
-
Unscored —
In aes_cmac of aes_cmac.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remo…
-
Unscored —CVE-2020-0113 Public exploit
In sendCaptureResult of Camera3OutputUtils.cpp, there is a possible out of bounds read due to a use after free. This co…
-
Unscored —
In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation. T…
-
Unscored —
In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle at…
-
Unscored —
In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to be…
-
Unscored —CVE-2020-0121 Public exploit
In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lea…
-
Unscored —CVE-2020-0114 Public exploit
In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent erro…
-
Unscored —
This module enables you to add a configured ReadSpeaker button for text-to-speech for your site visitors. The module do…
-
Unscored —
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions). The vulnerability could lead …
-
Unscored —
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions …
-
Unscored —
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions …
-
Medium 6.5
Openstack cinder Improper handling of ScaleIO backend credentials
An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using ope…
-
High 7.5
HTTP Request Smuggling in goliath
goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Tra…
-
High 8.6
Code Injection in mosc
mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.