Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
1,813 results · Feed
-
High 7.3
Prototype Pollution
In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
-
High 8.1
EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
-
High 7.5
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
-
High 7.3
Command Injection in mversion
In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases a…
-
Unscored —
Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing…
-
Unscored —
A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing…
-
Unscored —
An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing r…
-
Unscored —
A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing…
-
Unscored —
Memory leaks were discovered in the CoAP library in Arm Mbed OS 5.15.3 when using the Arm mbed-coap library 5.1.5. The …
-
Medium 5.4
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Ref…
-
Medium 4.4
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Ref…
-
Medium 6.1
An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redir…
-
Unscored —
CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log…
-
Unscored —
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is…
-
High 8.8
Dolibarr SQL injection vulnerability in accountancy/customer/card.php
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.…
-
Medium 6.8
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.15.2…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.15.2…
-
High 8.4
Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S be…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25,…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25,…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects MK62 before 1.0.4.92, MK…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25,…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25,…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RBK752 before 3.2.15.25,…
-
Unscored —
A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows…
-
Unscored —
An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. With…
-
Unscored —
An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered.
-
Unscored —
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execut…
-
Unscored —
HUAWEI P30 and HUAWEI P30 Pro with versions earlier than 10.1.0.135(C00E135R2P11) and versions earlier than 10.1.0.135(…
-
Unscored —
FusionSphere OpenStack 6.5.1 have an improper permissions management vulnerability. The software does not correctly per…
-
Unscored —
HUAWEI Mate 30 with versions earlier than 10.1.0.126(C00E125R5P3) have an information disclosure vulnerability. A logic…
-
Unscored —
Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predicta…