Archive
14 July 2020
Vulnerabilities first published on this day (UTC), newest first.
194 results · Feed
-
Unscored —
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
-
Unscored —
Microsoft Office Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper a…
-
Medium 4.6
TLS Validation Vulnerability in Envoy
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly…
-
Low 2.8
Nested directory structure can lead to Uncontrolled Resource Consumption in freewvs
In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted us…
-
Medium 6.4
Command Injection in iPear
In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal d…
-
Low 3.5
Stored XSS in October
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. Thi…
-
High 7.7
LDAP injection vulnerability in Traccar GPS Tracking System
Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges…
-
High 8.8
Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contai…
-
Medium 6.5
Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contai…
-
Unscored —
An issue was discovered in Verint Impact 360 15.1. At wfo/help/help_popup.jsp, the helpURL parameter can be changed to …
-
Unscored —
An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from ex…
-
Unscored —
An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which u…
-
Unscored —
SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailin…
-
Low 2.8
Uncontrolled Resource Consumption in freewvs
In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1.
-
Unscored —
Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint valid…
-
High 7.5
"Verify All" Returns Success Despite Validation Failures in Singularity
Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.
-
Unscored —
OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of re…
-
High 7.5
Execution Control List (ECL) Is Insecure in Singularity
Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file…
-
Unscored —
Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not …
-
Unscored —
In GOG Galaxy 1.2.67, there is a service that is vulnerable to weak file/service permissions: GalaxyClientService.exe. …
-
High 7.5
Infinite Loop in Apache Tomcat
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…
-
High 7.5CVE-2020-13934 EPSS 64%
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur…
-
Medium 6.1
Cross-site Scripting in RosarioSIS
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
-
Unscored —
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asse…
-
Unscored —
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.…
-
Unscored —
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation…
-
Unscored —
A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), …
-
Unscored —
A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All version…
-
Unscored —
A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All version…
-
Unscored —
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation…
-
Unscored —
A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All version…
-
Unscored —
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation…
-
Unscored —
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPL…
-
Unscored —
A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions >= V2.2 < V2.5.1). Affected device…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…