Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
108 results · Clear filters · Feed
-
Unscored —
OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php be…
-
Unscored —
**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is…
-
Critical 10.0
PAN-OS: Authentication Bypass in SAML Authentication
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-base…
KEV Mar 25, 2022 -
Medium 6.1CVE-2020-15368 Public exploit
AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering…
-
Unscored —CVE-2020-15363 Public exploit
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
-
Unscored —CVE-2020-15364 Public exploit
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
-
Medium 6.8CVE-2020-9047 Public exploit
exacqVision Software - Improper Verification of Cryptographic Signature
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with a…
-
Unscored —CVE-2020-14955 Public exploit
In Jiangmin Antivirus 16.0.13.129, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or…
-
High 7.5
Uncontrolled Resource Consumption in Apache Tomcat
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 conne…
-
Medium 6.3CVE-2019-4650 Public exploit
IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL …
-
Critical 10.0CVE-2018-21268 Public exploit
Node-Traceroute RCE Vulnerability
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can …
-
Unscored —CVE-2020-15046 Public exploit
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers t…
-
Unscored —CVE-2020-15038 Public exploit
The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
-
Critical 9.8
Improper Authentication in Apache Spark
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application…
-
Unscored —CVE-2020-14073 Public exploit
XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can …
-
Unscored —CVE-2020-14974 Public exploit
The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running …
-
Unscored —CVE-2020-14965 Public exploit
On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and …
-
Unscored —CVE-2020-14943 Public exploit
The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cro…
-
Unscored —CVE-2020-14944 Public exploit
Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can al…
-
Unscored —
A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an aut…
-
Unscored —CVE-2020-14946 Public exploit
downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and …
-
Critical 9.8
Improper Authentication in Apache Shiro
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
-
Unscored —CVE-2020-11519 Public exploit
The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to read or write to physical disc sec…
-
Unscored —
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup param…
-
Unscored —CVE-2020-13159 Public exploit
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name,…
-
Unscored —CVE-2020-14461 Public exploit
Zyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI.
-
Low 3.5CVE-2020-11097 Public exploit
OOB read in ntlm_av_pair_get in FreeRDP
In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.
-
Unscored —CVE-2020-14930 Public exploit
An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-re…
-
Medium 5.3CVE-2020-9495 Public exploit
Injection in Apache Archiva
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LD…
-
Medium 6.3CVE-2020-13277 Public exploit
An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and late…
-
Critical 9.8
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
-
High 7.5CVE-2020-8162 Public exploit
Circumvention of file size limits in ActiveStorage
A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.
-
Unscored —
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execut…
-
Unscored —CVE-2020-9332 Public exploit
ftusbbus2.sys in FabulaTech USB for Remote Desktop through 2020-02-19 allows privilege escalation via crafted IoCtl cod…
-
Unscored —
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lea…
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might al…
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.
-
Unscored —CVE-2020-14210 Public exploit
Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to…
-
Unscored —CVE-2020-9289 Public exploit
Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, Fo…
-
High 7.0CVE-2020-13162 Public exploit
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down…