Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
1,813 results · Feed
-
Medium 4.3
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update perm…
-
Medium 4.8
OpenCart Cross-site Scripting
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor state…
-
Unscored —
An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary comma…
-
Unscored —
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration …
-
Unscored —
Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chun…
-
Unscored —CVE-2020-10757 Public exploit
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allo…
-
Medium 5.0
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. Th…
-
Unscored —
SONY Wireless Headphones WF-1000X, WF-SP700N, WH-1000XM2, WH-1000XM3, WH-CH700N, WH-H900N, WH-XB700, WH-XB900N, WI-1000…
-
Unscored —
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…
-
Medium 6.1CVE-2020-13973 Public exploit
Cross-site scripting in json-sanitizer
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where…
-
Unscored —
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allow…
-
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024 -
Unscored —
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error q…
-
Unscored —
Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow u…
-
High 7.4
The filename of uploaded files vulnerable to stored XSS in Bolt CMS
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload …
-
High 8.6CVE-2020-4040 Public exploit
CSRF issue on preview pages in Bolt CMS
Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of p…
-
High 7.4
Reflected XSS in GraphQL Playground
GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in g…
-
Unscored —
D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search …
-
Unscored —CVE-2020-13884 Public exploit
Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows lo…
-
Unscored —CVE-2020-13885 Public exploit
Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during…
-
Unscored —
Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile…
-
Unscored —
A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media …
-
Unscored —CVE-2020-13432 EPSS 31%
rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to…
-
Medium 4.3
It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-…
-
Unscored —
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription …
-
Unscored —
An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficien…
-
Unscored —
OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.[a link that opens another app in the browser can be mani…
-
Unscored —
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Uplo…
-
Unscored —
The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via …
-
High 7.5
Insufficient output escaping of attachment names in PHPMailer
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.
-
Unscored —CVE-2020-13866 Public exploit
WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain privilege…
-
Unscored —
XForms submissions could overwrite local files
ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows d…
-
Low 3.5
Information disclosure in external interface
BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior versions.
-
Unscored —
remote graphics contained in docx format retrieved in 'stealth mode'
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resou…
-
Unscored —
Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intend…
-
Unscored —
In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text…
-
Unscored —
In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has u…
-
Unscored —
Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG…
-
Medium 5.4
Angular vulnerable to Cross-site Scripting
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
-
High 8.0
An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages inc…