Archive
21 July 2020
Vulnerabilities first published on this day (UTC), newest first.
18 results · Feed
-
Unscored —
Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buff…
-
Unscored —
Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficien…
-
Unscored —
LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled.
-
Medium 6.5
Improper access control on dashboard form in PrestaShop
In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
-
Unscored —
In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a loc…
-
Unscored —
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows …
-
Unscored —
In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privile…
-
Unscored —
In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrom…
-
High 8.8
Exposure of Resource to Wrong Sphere in LibreNMS
An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
-
Unscored —
Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe…
-
Unscored —
A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive infor…
-
Unscored —
A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privil…
-
Medium 6.5CVE-2020-15873 Public exploit
LibreNMS SQL Injection vulnerability
In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.
-
Unscored —
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the d…
-
High 8.2
PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.
-
Unscored —
mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorre…
-
Unscored —CVE-2020-12432 Public exploit
The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to …
-
High 7.5
Improper Input Validation in sails-hook-sockets
Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.