Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
1,428 results · Feed
-
Medium 6.5
Denial of Service in Synergy
In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xffffffff (4294967295) if the servers memory is less than 4 GB. It was verified that this issue does not cause a crash thro…
-
High 8.1
Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication Plugin
Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
-
High 8.0
Stored XSS vulnerability in Jenkins Deployer Framework Plugin
Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
-
High 8.0
Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
-
High 8.0
Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin
Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
-
High 8.0
Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.
-
High 8.0
Stored XSS vulnerability in Jenkins console links
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
-
High 8.0
Stored XSS vulnerability in Jenkins job build time trend
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.
-
High 8.0
Stored XSS vulnerability in Jenkins upstream cause
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
-
High 8.0
Stored XSS vulnerability in Jenkins 'keep forever' badge icon
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
-
Unscored —
Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.
-
High 7.4CVE-2020-8203 Public exploit
Prototype Pollution in lodash
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
-
Unscored —
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor…
-
Unscored —
An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer …
-
Unscored —
An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result …
-
Unscored —
An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose R…
-
Unscored —
An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified …
-
Unscored —
An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_rando…
-
Unscored —
An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy c…
-
Unscored —
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
-
Unscored —
IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04
-
Unscored —
In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external e…
-
Medium 4.3
Web Gateway (MWG) - Inappropriate Encoding for output context
Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL.
-
Unscored —
"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which com…
-
Unscored —
Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server …
-
Unscored —
Nessus 8.10.0 and earlier were found to contain a Stored XSS vulnerability due to improper validation of input during s…
-
Unscored —
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successf…
-
Unscored —
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of thi…
-
Unscored —
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this …
-
Unscored —
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command…
-
Unscored —
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use…
-
Unscored —
Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an a…
-
Medium 4.1CVE-2020-2978 Public exploit
Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that …
-
Unscored —CVE-2020-1481 EPSS 24%
A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source co…
-
High 7.5
Infinite loop in .Net Bond
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
-
Unscored —
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its …
-
Unscored —
An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.T…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the SharedStream Library handles objects in memory, aka …
-
Unscored —
An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based),…
-
Unscored —
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary lo…