Archive
23 July 2020
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
Unscored —
A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could a…
-
Unscored —
A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could all…
-
Unscored —
A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and olde…
-
Unscored —
A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and pr…
-
Unscored —
A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and…
-
Unscored —
A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 an…
-
Unscored —
**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 …
-
Unscored —
A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Upda…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 8.0
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
Unscored —
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD In…
-
Unscored —
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD In…
-
Unscored —
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD In…
-
Unscored —
An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe w…
-
Unscored —
The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters …
-
Critical 9.8
DevSpace vulnerable to remote code execution
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.
-
Unscored —
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute ar…
-
Medium —
Storing Password in Local Storage
The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time tha…
-
Unscored —
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
-
Unscored —CVE-2020-15916 Public exploit
goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary syste…
-
Medium 5.5
Kubernetes node disk Denial of Service by writing to container /etc/hosts
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction m…
-
Medium 5.4
IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Unscored —
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3…
-
High 7.5
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE …
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmwa…
-
Critical 9.8
This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware versi…
-
Medium 5.9
This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA…
-
High 7.5
This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmwar…
-
Medium 5.9
Credential leakage when failing to mount
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.
-
Unscored —
Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC…
-
Unscored —
httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.
-
Medium 6.1
MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability
A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name.
-
Unscored —
A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines f…
-
Medium 6.1
MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability
A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reporte…
-
Unscored —
A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL c…
-
Medium 5.4
MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment
A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment.
-
High 8.8
MunkiReport reportdata module SQL injection vulnerability
A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint.
-
High 8.8
MunkiReport Software Update module is vulnerable to SQL injection
A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.
-
Unscored —
The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attack…