Archive
30 July 2020
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Unscored —
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information …
-
Unscored —
The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to …
-
Unscored —
A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and …
-
Medium 6.1CVE-2020-15129 Scanner template
Open redirect in Traefik
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwar…
-
Unscored —
An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. Missing validation checks on CRL p…
-
Unscored —
An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a la…
-
High —
Vulnerability in RPKI manifest validation
An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin …
-
High 7.5
False-positive validity for NFT1 genesis transactions in SLPJS
In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child…
-
High 7.5
False-positive validity for NFT1 genesis transactions in SLP Validate
In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly val…
-
Unscored —CVE-2020-16157 EPSS 14%
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
-
High 7.8
DaviewIndy Heap-based Buffer Overflow Vulnerability
DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
-
High 7.8
DaviewIndy Heap-based Buffer Overflow Vulnerability
DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
-
High 7.8
DaviewIndy Use-After-Free Vulnerability
DaviewIndy 8.98.7 and earlier version contain Use-After-Free vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
-
Unscored —
HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when…
-
Unscored —
The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity…
-
Unscored —
An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T).…
-
Unscored —
An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core …
-
Unscored —
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injectio…
-
Unscored —CVE-2020-10713 Public exploit
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB ver…
-
Medium 5.9
IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attac…
-
Medium 5.3
IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in fur…
-
High 7.2
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perfor…
KEV Mar 7, 2022 -
Medium —
Denial of service in fastify
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
-
Unscored —
Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when…
-
Unscored —
A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.
-
Unscored —
An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users pri…
-
Unscored —
A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used …
-
Unscored —
An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change …
-
Unscored —
An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to…
-
Unscored —
A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arb…
-
Unscored —
An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attack…
-
Unscored —
A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perfor…
-
Unscored —
A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the adm…
-
Unscored —
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link w…
-
Unscored —
Use after free issue while processing error notification from camx driver due to not properly releasing the sequence da…
-
Unscored —
Possible out of bounds read due to a missing bounds check and could lead to local information disclosure in the wifi dr…
-
Unscored —
Possible out of bound access while processing assoc response from host due to improper length check before copying into…
-
Unscored —
Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response …
-
Unscored —
Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Comp…
-
Unscored —
Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snap…