Archive
12 June 2020
Vulnerabilities first published on this day (UTC), newest first.
28 results · Feed
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to…
-
Unscored —
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of a…
-
Unscored —
Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle…
-
Unscored —
A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into …
-
Medium 6.3
Server-Side Request Forgery in Karaf
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In…
-
Unscored —
The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacke…
-
Medium 6.8
Authenticated XSS via media attachment page in WordPress
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user wh…
-
Medium 5.7
Open redirect in wp_validate_redirect() in WordPress
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previousl…
-
Low 2.4
Authenticated self-XSS via theme uploads in WordPress
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XS…
-
Low 3.5
set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low pri…
-
Medium 5.4
Authenticated XSS through embed block in WordPress
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to…
-
Unscored —
An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd serv…
-
Unscored —
Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier,…
-
Unscored —
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. Successful exp…
-
Unscored —
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. Successful exp…
-
Unscored —
Adobe Framemaker versions 2019.0.5 and below have a memory corruption vulnerability. Successful exploitation could lead…
-
Unscored —
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (stored) vulnerability. Successful exploi…
-
Unscored —
Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. Successful exploitation could l…
-
Unscored —
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability. Successful exploitation co…
-
Unscored —
Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful e…
-
Unscored —
Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Succes…
-
Unscored —
Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. Successful exploitation could l…
-
Medium 5.4
IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Medium 6.2
GeoVision Door Access Control Device - Hardcoded privileged password
GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.
-
Medium 4.0
GeoVision Door Access Control Device - Information disclosure vulnerability
GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.
-
Medium 5.9
GeoVision Door Access Control Device - Shared cryptographic keys
GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages.
-
Unscored —
Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the instal…
-
Low 3.3
A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a loca…