Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
91 results · Clear filters · Feed
-
Unscored —CVE-2020-15780 Public exploit
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI t…
-
Unscored —
Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allo…
-
Unscored —CVE-2020-15051 Public exploit
An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Ad…
-
Unscored —CVE-2020-14066 Public exploit
IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to acce…
-
Unscored —CVE-2020-14065 Public exploit
IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.
-
Unscored —CVE-2020-14064 Public exploit
IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.
-
Unscored —
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php s…
-
Unscored —CVE-2020-15716 Public exploit
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php scri…
-
Medium 6.6CVE-2020-2969 Public exploit
Vulnerability in the Data Pump component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, …
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Sep 18, 2024 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 7.4CVE-2020-8203 Public exploit
Prototype Pollution in lodash
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
-
Unscored —
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
-
Medium 4.1CVE-2020-2978 Public exploit
Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that …
-
Unscored —CVE-2020-1362 Public exploit
An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka…
-
Critical 10.0
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle re…
KEV Nov 3, 2021 -
High 7.8
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulne…
KEV Nov 3, 2021 -
Unscored —
SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailin…
-
High 7.5
Infinite Loop in Apache Tomcat
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…
-
Critical 9.8
Deserialization of Untrusted Data in Apache Dubbo
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will e…
-
Critical 9.8
Command Injection in Kylin
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to exe…
-
Critical 10.0
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …
KEV Nov 3, 2021 -
Medium 5.3
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configurati…
-
Unscored —
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in …
-
Unscored —
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary f…
-
Critical 9.8
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary …
KEV Nov 3, 2021 -
Unscored —
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator…
-
Medium 6.5
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
Critical 9.4
Operation on a Resource after Expiration or Release in Jetty Server
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the Byte…
-
Unscored —
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and …
-
Medium 5.3CVE-2020-7693 Public exploit
Denial of Service (DoS)
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
-
Unscored —
D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOT…
-
High 8.1CVE-2020-2034 Public exploit
PAN-OS: OS command injection vulnerability in GlobalProtect portal
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This is…
-
Unscored —CVE-2020-5839 Public exploit
Symantec Endpoint Detection And Response, prior to 4.4, may be susceptible to an information disclosure issue, which is…
-
Unscored —CVE-2020-15600 Public exploit
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
-
Unscored —CVE-2020-15599 Public exploit
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
-
Unscored —CVE-2020-15367 Public exploit
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit t…
-
Unscored —CVE-2020-15392 Public exploit
A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recov…
-
Critical 9.8
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,…
KEV Nov 3, 2021 -
Medium 6.5CVE-2019-14900 Public exploit
SQL Injection in Hibernate ORM
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw c…