Archive
22 June 2020
Vulnerabilities first published on this day (UTC), newest first.
80 results · Feed
-
Unscored —CVE-2020-14943 Public exploit
The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cro…
-
Unscored —CVE-2020-14944 Public exploit
Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can al…
-
Unscored —
A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an aut…
-
Unscored —CVE-2020-14946 Public exploit
downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and …
-
Unscored —
IOBit Advanced SystemCare Free 13.5.0.263 allows local users to gain privileges for file deletion by manipulating the C…
-
Unscored —
In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpo…
-
Unscored —
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leadin…
-
Critical 9.8
Improper Authentication in Apache Shiro
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
-
High 8.0
A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which trigger…
-
Medium 4.7
A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay…
-
High 8.0
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr …
-
Unscored —CVE-2020-11519 Public exploit
The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to read or write to physical disc sec…
-
Unscored —
The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory a…
-
Medium 6.4
A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks pr…
-
Unscored —
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup param…
-
Medium 6.6
Wildfly Unsafe Deserialization Vulnerability
A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.
-
Unscored —
The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.
-
Unscored —CVE-2020-13159 Public exploit
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name,…
-
Unscored —
The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation.
-
Unscored —
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastnam…
-
Unscored —
Verint Workforce Optimization (WFO) 15.2 allows HTML injection via the "send email" feature.
-
Unscored —
Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Vibe…
-
Unscored —
Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticate…
-
Unscored —
The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XS…
-
Unscored —
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it pr…
-
Medium 4.1
Use After Free in in cups_update_info in LoRa Basics Station
In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message (https://doc.sm.tc/station/cupsproto.html#http-post-response) w…
-
Medium 4.6
Cross-site Scripting in CSS Validator
In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.
-
Medium 6.3
Heap-based Buffer Overflow in APNSwift
In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fixed in 1.0.1.
-
Unscored —
documents_add.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded t…
-
Low 3.8
Command Injection in Limdu trainBatch function
In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.
-
Unscored —
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexp…
-
High 8.7
Improper Access Control in Conjur OSS Helm Chart
In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an attacker to gain full read & write access to the Conjur Postgres database, inclu…
-
Unscored —
An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a…
-
High 8.6
Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system
-
Unscored —
Kordil EDMS through 2.2.60rc3 allows stored XSS in users_edit.php, users_management_edit.php, and user_management.php.
-
Critical 9.3
Priviged Escalation in Google Cloud Platform's Guest-OSLogin
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach…
-
High 7.3
Priviged Escalation in Google Cloud Platform's Guest-OSLogin
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role…
-
Critical 9.3
Priviged Escalation in Google Cloud Platform's Guest-OSLogin
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with …
-
Unscored —
WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters.
-
Unscored —
In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local …