Skip to content
OpenAdvisories

Archive

20 July 2020

Vulnerabilities first published on this day (UTC), newest first.

← June 2020 2020 / July /20 August 2020 →
  1. 171
  2. 254
  3. 311
  4. 41
  5. 513
  6. 628
  7. 770
  8. 818
  9. 951
  10. 1024
  11. 11 
  12. 12 
  13. 1320
  14. 14194
  15. 15278
  16. 1663
  17. 1773
  18. 18 
  19. 19 
  20. 2036
  21. 2118
  22. 2274
  23. 2341
  24. 2428
  25. 255
  26. 26 
  27. 2725
  28. 2886
  29. 2962
  30. 3051
  31. 3133
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2020-13932

    Cross-site Scripting (XSS) in Apache ActiveMQ Artemis

    In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in…

    org.apache.activemq:apache-artemis Maven
  • Medium 4.8
    CVE-2020-3442

    DuoConnect SSH Connection Vulnerability

    The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance. When a user initiates an SSH connection to a DNG-protected host for the first time using DuoConnect, the user’s browser is opened to a login screen in order…

    Cisco DUO Connect Network devices
  • Medium 5.7
    CVE-2020-15118

    Cross-Site Scripting in Wagtail

    In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as form.as_p, any HTML tags used…

    wagtail wagtail wagtail PyPI
  • Medium 4.2
    CVE-2020-15111

    CRLF vulnerability in Fiber

    In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link …

    gofiber fiber github.com/gofiber/fiber Go
  • Medium 6.1
    CVE-2020-7680 Public exploit

    Cross-site Scripting in docsify

    docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after th…

    docsify npm
  • Medium 4.3
    CVE-2020-12027 Public exploit EPSS 53%

    Rockwell Automation FactoryTalk View SE

    All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built …

    Rockwell Automation FactoryTalk® View SE ICS / OT
  • Medium 5.9
    CVE-2020-4527

    IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set …

    IBM Planning Analytics
  • Medium 6.5
    CVE-2020-4466

    IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due …

    IBM MQ for HPE NonStop
  • Medium 4.3
    CVE-2020-4361

    IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addre…

    IBM Planning Analytics