Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
253 results · Clear filters · Feed
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Pa…
-
High 7.5
Grin insufficient data validation
Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.
-
High 7.5
Directory Traversal
This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
-
High 7.5
Directory Traversal
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
-
High 7.5
Directory Traversal
This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.
-
High 7.5
Directory Traversal
This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
-
High 7.5
Directory Traversal
This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.
-
High 7.5
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a u…
KEV Nov 3, 2021 -
High 7.3
An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that co…
-
High 7.3
A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could all…
-
High 7.8
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick chara…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 8.0
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
High 7.5
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE …
-
High 7.5
This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmwar…
-
High 8.8
MunkiReport reportdata module SQL injection vulnerability
A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint.
-
High 8.8
MunkiReport Software Update module is vulnerable to SQL injection
A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.
-
High 7.8
bsdiff4 out-of-bounds write via patch file
A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
-
High 7.5
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker …
-
High 7.5
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files…
KEV Nov 3, 2021 -
High 7.8
Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead t…
-
High 7.8
Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead …
-
High 7.8
Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead …
-
High 8.2
D-Link DSL-7740C - Command Injection
D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.
-
High 8.8
Exposure of Resource to Wrong Sphere in LibreNMS
An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
-
High 8.2
PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.
-
High 7.5
Improper Input Validation in sails-hook-sockets
Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
-
High 7.4
Command injection in Radare2
In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a…