Archive
10 June 2020
Vulnerabilities first published on this day (UTC), newest first.
25 results · Clear filters · Feed
-
High 8.6
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed…
-
High 7.1
Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability…
-
High 7.7
Phar unserialization vulnerability in phpMussel
phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk …
-
High 7.5
Allocation of Resources Without Limits or Throttling in Undertow
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.
-
High 7.5
Information Disclosure in HashiCorp Vault
HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.
-
High 8.8
Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code vi…
-
High 7.0
GlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgrade
A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges. This issue can be exploited only while performing a GlobalProtect app upgrade. This issue affects: G…
-
High 7.2
PAN-OS: OS command injection vulnerability in management interface certificate generator
An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configurat…
-
High 7.2
PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification
An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PA…
-
High 7.2
PAN-OS: Buffer overflow in authd authentication response
A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 …
-
High 7.8
Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path
A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code executi…
-
High 7.5
HTTP Request Smuggling in goliath
goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Tra…
-
High 8.6
Code Injection in mosc
mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.
-
High 7.5
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to …
-
High 8.8
Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an atta…
-
High 7.5
Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which…
-
High 7.5
Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. Th…
-
High 7.5
Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authenti…
-
High 7.5
Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an at…
-
High 8.6
SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions wh…
-
High 7.6
SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Ser…
-
High 8.2
SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an…
-
High 7.8
Symbolic Link vulnerability during DAT update
Privilege Escalation vulnerability during daily DAT updates when using McAfee Virus Scan Enterprise (VSE) prior to 8.8 Patch 15 allows local users to cause the deletion and creation of files they would not normally have permission to through altering the targ…
-
High 7.0
VSE Escalation of Privileges through Alert pop-up window
Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow local users to interact with the On-Access Scan Messages - Threat Alert Window with elevated privileges via runnin…
-
High 7.5
Privilege escalation in ToPS for Mac
Privilege escalation vulnerability in McAfee Total Protection (ToPS) for Mac OS prior to 4.6 allows local users to gain root privileges via incorrect protection of temporary files.