Archive
7 July 2020
Vulnerabilities first published on this day (UTC), newest first.
70 results · Feed
-
Unscored —CVE-2020-15600 Public exploit
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
-
Unscored —CVE-2020-15599 Public exploit
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
-
Medium 5.0
Memory leak in wpanctl can lead to DoS
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the servic…
-
Unscored —
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the p…
-
Unscored —
Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When a…
-
Unscored —
SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with …
-
Unscored —
SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax ph…
-
Unscored —
SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with aj…
-
Unscored —
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
-
Medium 5.3
Sensitive information exposure through logs in npm-registry-fetch
Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is pri…
-
Medium 4.4
Sensitive information exposure through logs in npm cli
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is print…
-
Unscored —
WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.
-
High —
Denial of service due to reference expansion in versions earlier than 4.0
### Impact The CBOR library supports optional tags that enable CBOR objects to contain references to objects within them. Versions earlier than 4.0 resolved those references automatically. While this by itself doesn't cause much of a security problem, a denia…
-
Unscored —
RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer e…
-
Medium 5.9
Potentially sensitive data exposure in Symfony Web Socket Bundle
### Impact Inside `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` does not succeed. Th…
-
Medium 6.1
DOM-based cross-site scripting in Froala Editor
Froala Editor before 3.2.3 allows XSS.
-
Unscored —
The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. T…
-
Unscored —
NeDi 1.9C is vulnerable to a cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
High 8.8
Remote code execution in turn extension for TYPO3
The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.
-
Unscored —
"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to emb…
-
Unscored —
"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary J…
-
Unscored —CVE-2020-15367 Public exploit
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit t…
-
Unscored —CVE-2020-15392 Public exploit
A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recov…
-
Unscored —
Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Conne…
-
Unscored —
GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.
-
Medium 5.3
Incorrect access control in typo3_forum
The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.
-
Medium 5.4
jh_captcha for Typo3 XSS Vulnerability
The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.
-
Unscored —
The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.
-
Medium 5.4
ke_search for Typo3 XSS Vulnerability
The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.
-
Unscored —
A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.1…
-
Unscored —
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Cameralyzer allows attackers to wri…