23 June 2020

27 results · Feed

• Critical 9.8
  CVE-2020-9480 Public exploit Scanner template EPSS 30%

  Improper Authentication in Apache Spark

  In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.11 Maven PyPI
  Jun 23, 2020
• Unscored —
  CVE-2020-12033

  In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not…

  Jun 23, 2020
• Unscored —
  CVE-2020-12021

  In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cro…

  Jun 23, 2020
• High 7.4
  CVE-2020-5367

  Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions …

  Dell Unisphere for PowerMax, Unisphere for PowerMax Virtual Appliance, PowerMax OS
  Jun 23, 2020
• Medium 6.4
  CVE-2020-5345

  Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions …

  Dell Unisphere for PowerMax
  Jun 23, 2020
• High 8.8
  CVE-2020-13155

  NukeViet Cross-Site Request Forgery (CSRF)

  clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI.

  nukeviet/nukeviet Packagist
  Jun 23, 2020
• Medium 6.5
  CVE-2020-13156

  NukeViet Cross-Site Request Forgery (CSRF)

  modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI.

  nukeviet/nukeviet Packagist
  Jun 23, 2020
• Medium 6.5
  CVE-2020-13157

  NukeViet Cross-Site Request Forgery (CSRF)

  modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed.

  nukeviet/nukeviet Packagist
  Jun 23, 2020
• Unscored —
  CVE-2020-14073 Public exploit

  XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can …

  Jun 23, 2020
• Unscored —
  CVE-2020-14974 Public exploit

  The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running …

  Jun 23, 2020
• Unscored —
  CVE-2020-14975

  The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to delete, move, or copy arbitrary files via IOCTL code…

  Jun 23, 2020
• Unscored —
  CVE-2020-14976

  GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary f…

  Jun 23, 2020
• Unscored —
  CVE-2020-14977

  An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client,…

  Jun 23, 2020
• Unscored —
  CVE-2020-14978

  An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can c…

  Jun 23, 2020
• Medium 5.3
  CVE-2020-4188

  IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends …

  IBM Security Guardium
  Jun 23, 2020
• Medium 5.0
  CVE-2020-11068

  Potential Buffer Overflow in LoRaMac-node

  In LoRaMac-node before 4.4.4, a reception buffer overflow can happen due to the received buffer size not being checked. This has been fixed in 4.4.4.

  LoRa LoRaMac-node
  Jun 23, 2020
• Unscored —
  CVE-2020-9438

  Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred …

  Jun 23, 2020
• Unscored —
  CVE-2020-14971

  Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup…

  Jun 23, 2020
• Unscored —
  CVE-2020-14965 Public exploit

  On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and …

  Jun 23, 2020
• Unscored —
  CVE-2020-4028

  Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to t…

  Atlassian Jira Server and Data Center Web / CMS
  Jun 23, 2020
• Unscored —
  CVE-2020-14993

  A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attac…

  Jun 23, 2020
• Unscored —
  CVE-2020-14938

  An issue was discovered in map.c in FreedroidRPG 1.0rc2. It assumes lengths of data sets read from saved game files. It…

  freedroidrpg freedroidrpg Debian Ubuntu
  Jun 23, 2020
• Unscored —
  CVE-2020-14939

  An issue was discovered in savestruct_internal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts t…

  freedroidrpg freedroidrpg Debian Ubuntu
  Jun 23, 2020
• Unscored —
  CVE-2020-14940

  An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading…

  tuxguitar tuxguitar Debian Ubuntu
  Jun 23, 2020
• Unscored —
  CVE-2020-5594

  Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules all versions contain a vulnerability that allows…

  Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules ICS / OT
  Jun 23, 2020
• Critical 9.8
  CVE-2020-12782

  Openfind MailGates - Command Injection

  Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will be triggered and gain unauthorized access to system files.

  Openfind MailAudit MailGates
  Jun 23, 2020
• Unscored —
  CVE-2019-20409

  The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed r…

  Atlassian Jira Server Web / CMS
  Jun 23, 2020