Archive
1 July 2020
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Unscored —
openSIS before 7.4 allows SQL Injection.
-
Unscored —
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack.…
-
Unscored —
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the da…
-
Unscored —
In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections fo…
-
Medium 5.9
Insecure Encryption
Data is truncated wrong when its length is greater than 255 bytes.
-
Unscored —
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests o…
-
Unscored —
"A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacke…
-
Unscored —
"HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability. An attacker could use this vulnerability to s…
-
Medium 5.3
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file,…
-
Unscored —CVE-2020-15478 Public exploit
The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
-
Unscored —
In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_i…
-
Unscored —
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/prot…
-
Unscored —
In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib…
-
Unscored —
In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.
-
Unscored —
In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-af…
-
Unscored —
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/proto…
-
Unscored —
ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif_decode in jfif.c.
-
Unscored —CVE-2020-15468 Public exploit
Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter.
-
Unscored —
Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration pe…
-
Unscored —
The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, fr…
-
Unscored —
The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, an…
-
Unscored —
The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian…
-
Unscored —
The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, an…
-
Unscored —
The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.…
-
Unscored —
The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbi…
-
Unscored —
The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from …
-
Unscored —CVE-2020-14166 Public exploit
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows rem…
-
Unscored —
The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbit…
-
Unscored —
The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attac…
-
Unscored —
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the co…
-
Critical 9.8
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic…
KEV Nov 3, 2021