Archive
1 July 2020
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Medium 6.5
Denial of service in table parsing in cmark-gfm
The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue do…
-
Medium 6.1
Cross-site scripting in TileServer GL
An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.
-
Unscored —
An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vuln…
-
Unscored —
An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities ex…
-
Unscored —
An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The …
-
Unscored —
An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. T…
-
Unscored —
An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user i…
-
Unscored —
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal w…
-
Critical 9.8
OS Command Injection in Locutus
php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
-
High 8.4
Command Injection
The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
-
Unscored —
Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to rea…
-
Unscored —
Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insuf…
-
Unscored —
Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of t…
-
Critical 9.8
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attacker…
-
High 7.8
Phoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code execution
mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.
-
High 7.8CVE-2020-12497 EPSS 15%
Phoenix Contact Automation Worx <= 1.87: stack-based overflow
PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.
-
High 8.8
An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted A…
-
Unscored —
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authoriz…
-
Unscored —CVE-2020-5903 Public exploit
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vul…
-
Unscored —
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize…
-
Unscored —
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CS…
-
Unscored —
In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in…
-
Unscored —
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 header…
-
Unscored —
In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the acce…
-
Medium 5.1
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local a…
-
High 7.5
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauth…
-
Medium 6.2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
Medium 6.2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a bu…
-
Medium 5.3
IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service c…
-
Medium 5.3
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a de…
-
Low 2.7
IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The inform…
-
Low 2.7
IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive natur…
-
Low 3.7
IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or sess…
-
Medium 6.3
IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read …
-
Unscored —
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 cl…
-
Unscored —
openSIS through 7.4 allows Directory Traversal.
-
Unscored —
openSIS through 7.4 has Incorrect Access Control.
-
Unscored —
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many conn…
-
Unscored —
openSIS through 7.4 allows SQL Injection.