Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
275 results · Clear filters · Feed
-
Medium 4.7
Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability
A vulnerability in the handling of IEEE 802.11w Protected Management Frames (PMFs) of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to terminate a valid user connection…
-
Medium 6.7
Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution Vulnerability
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying operating system (OS) with…
-
Medium 6.0
Cisco IOS and IOS XE Software Tcl Denial of Service Vulnerability
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause a denial of service (DoS) condition on an affected system. Th…
-
Medium 5.9
DoS or local data modification via malicious record IDs in WatermelonDB
In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the databas…
-
Medium 6.0
Calico nodes IPv6 traffic redirection from route advertisment
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interf…
-
Medium 6.5
IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a…
-
Medium 5.3
IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks aga…
-
Medium 4.1
IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, wh…
-
Medium 6.8
IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for …
-
Medium 6.1
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 6.0CVE-2020-10749 Public exploit
containernetworking/plugins vulnerable to MitM attacks
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IP…
-
Medium 6.1
XSS in Django
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
-
Medium 5.9CVE-2020-13254 Public exploit
Data leakage via cache key collision in Django
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
-
Medium 4.3
Missing permission check in Jenkins Project Inheritance Plugin
Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure.
-
Medium 6.1
XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
-
Medium 4.3
Missing permission check in Jenkins Project Inheritance Plugin
Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.
-
Medium 5.4
Stored XSS vulnerability in Jenkins Compact Columns Plugin
Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.
-
Medium 5.4
Stored XSS vulnerability in Jenkins ECharts API Plugin
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.
-
Medium 5.4
Stored XSS vulnerability in Jenkins ECharts API Plugin
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
-
Medium 5.4
CSRF vulnerability in Jenkins Swarm Plugin
A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels.
-
Medium 5.4
Improper permission checks in Jenkins Swarm Plugin
Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels.
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
-
Medium 6.7
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digit…
-
Medium 6.1
Grafana XSS via adding a link in General feature
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
-
Medium 6.1
Grafana XSS via a column style
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
-
Medium 6.1
Grafana XSS in Dashboard Text Panel
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
-
Medium 6.1
MediaWiki Open Redirect vulnerability
resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.
-
Medium 5.4
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.1
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 5.9
IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to dec…
-
Medium 5.4
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.1
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.0CVE-2020-13401 Public exploit
Improper Input Validation in Docker Engine
An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
-
Medium 6.5
A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in…
-
Medium 6.3
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elev…