Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
1,428 results · Feed
-
High 7.6
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A …
-
Medium 5.4
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Unscored —
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER a…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There ar…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attack…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attacker…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is…
-
Critical 9.8
SQL Injection in Kylin
Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Us…
-
Critical 9.8
Command Injection in Kylin
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to exe…
-
Unscored —
Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (X…
-
Medium 4.2
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user…
-
Medium 6.3
Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cook…
-
Critical 10.0
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …
KEV Nov 3, 2021 -
Medium 6.1
SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controll…
-
Medium 5.4
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited…
-
Medium 6.1
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-cont…
-
Medium 5.4
SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to…
-
Medium 5.3
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configurati…
-
Medium 4.6
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to…
-
High 7.7
SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain co…
-
Medium 5.8
SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver…
-
Low 2.7
SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to acce…
-
Medium 4.3
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be…
-
Unscored —
In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
-
Unscored —
mach is unmaintained
Last release was almost 4 years ago. Maintainer(s) seem to be completely unreachable. ## Possible Alternative(s) These may or may not be suitable alternatives and have not been vetted in any way; - [mach2](https://crates.io/crates/mach2) - direct fork
-
Unscored —
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in …
-
Medium —
Command Injection in standard-version
# GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2020-111` The [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [standard-version](https://github.com/conventional-changelog/standard-versio…
-
Unscored —
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA…
-
Unscored —
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorre…
-
Unscored —
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary f…
-
Critical 9.8
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary …
KEV Nov 3, 2021 -
Unscored —
An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to e…
-
Unscored —
A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticate…
-
Unscored —
A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to …
-
Medium 5.5
A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel C…
-
Unscored —CVE-2020-5766 Scanner template
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin …
-
Unscored —
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator…
-
Medium 5.9
IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to …
-
Unscored —
Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header t…