Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
1,813 results · Feed
-
High 7.0CVE-2020-13162 Public exploit
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down…
-
Unscored —
A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vi…
-
Unscored —
A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U…
-
Unscored —
A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed …
-
Unscored —
A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions)…
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStr…
-
Unscored —
A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service P…
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file …
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStr…
-
Unscored —
A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in …
-
Unscored —
A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the di…
-
Unscored —
RVD#2550: Terminate Critical Services in KUKA controller KR C4
Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt. After this a Re-Calibration of the brakes needs to be performed. Be noted that this only can be accomplished either by a Kuka technician or by Kuk…
-
Unscored —
BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to…
-
High 8.1CVE-2020-14195 Public exploit
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
-
Unscored —
OX App Suite through 7.10.3 allows SSRF.
-
Unscored —
OX App Suite through 7.10.3 allows XXE attacks.
-
Unscored —
OX App Suite through 7.10.3 allows XSS.
-
Unscored —
OX App Suite through 7.10.3 has Improper Input Validation.
-
Medium 5.3
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients bas…
-
Medium 5.9
IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to …
-
Unscored —
On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is bec…
-
Unscored —
This is an unbounded write into kernel global memory, via a user-controlled buffer size.Product: AndroidVersions: Andro…
-
Unscored —
In crus_sp_shared_ioctl we first copy 4 bytes from userdata into "size" variable, and then use that variable as the siz…
-
Unscored —
Function abc_pcie_issue_dma_xfer_sync creates a transfer object, adds it to the session object then continues to work w…
-
Unscored —
In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. …
-
Medium 5.3
Beckhoff: Etherleak in TwinCAT RT network driver
Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are n…
-
Critical 9.8
Expression Language Injection in Netflix Conductor
Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data i…
-
Unscored —
Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2…
-
Unscored —
Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, Affecting v…
-
Unscored —
I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions …
-
Medium 6.7
Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escal…
-
Unscored —
An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pair…
-
Unscored —
Webroot endpoint agents prior to version v9.0.28.48 did not protect the "%PROGRAMDATA%\WrData\PKG" directory against re…
-
Unscored —
Webroot endpoint agents prior to version v9.0.28.48 allows remote attackers to trigger a type confusion vulnerability o…
-
Unscored —
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin applicati…
-
Unscored —
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versi…
-
Unscored —
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versi…
-
Unscored —CVE-2020-12001 EPSS 12%
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versi…