Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
91 results · Clear filters · Feed
-
Critical 9.8
Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit w…
-
Critical 9.0
JMX Credential Deserialization in GemFire
VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticate…
-
Critical 9.9
Cisco SD-WAN vManage Software Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availab…
-
Critical 9.8
Cisco SD-WAN Solution Software Buffer Overflow Vulnerability
A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by send…
-
Critical 9.8
Cisco Data Center Network Manager Authentication Bypass Vulnerability
A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists b…
-
Critical 9.9
Privilege Escalation in kubevirt
A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenar…
-
Critical 9.8
Potential Remote Code Execution in TYPO3 with mediace extension
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cry…
-
Critical 9.4
OpenClinic GA
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands.
-
Critical 9.8
Command Injection
This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON…
-
Critical 9.6
Magento DOM-based Cross-site scripting vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Critical 9.1
Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.…
-
Critical 9.8
This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-…
-
Critical 9.8
DevSpace vulnerable to remote code execution
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmwa…