Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
1,428 results · Feed
-
Unscored —
An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities ex…
-
Unscored —
An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The …
-
Unscored —
An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. T…
-
Unscored —
An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user i…
-
Unscored —
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal w…
-
Critical 9.8
OS Command Injection in Locutus
php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
-
High 8.4
Command Injection
The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
-
Unscored —
Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to rea…
-
Unscored —
Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insuf…
-
Unscored —
Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of t…
-
Critical 9.8
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attacker…
-
High 7.8
Phoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code execution
mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.
-
High 7.8CVE-2020-12497 EPSS 15%
Phoenix Contact Automation Worx <= 1.87: stack-based overflow
PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.
-
High 8.8
An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted A…
-
Unscored —
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authoriz…
-
Unscored —CVE-2020-5903 Public exploit
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vul…
-
Unscored —
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize…
-
Unscored —
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CS…
-
Unscored —
In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in…
-
Unscored —
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 header…
-
Unscored —
In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the acce…
-
Medium 5.1
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local a…
-
High 7.5
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauth…
-
Medium 6.2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
Medium 6.2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a bu…
-
Medium 5.3
IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service c…
-
Medium 5.3
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a de…
-
Low 2.7
IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The inform…
-
Low 2.7
IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive natur…
-
Low 3.7
IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or sess…
-
Medium 6.3
IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read …
-
Unscored —
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 cl…
-
Unscored —
openSIS through 7.4 allows Directory Traversal.
-
Unscored —
openSIS through 7.4 has Incorrect Access Control.
-
Unscored —
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many conn…
-
Unscored —
openSIS through 7.4 allows SQL Injection.
-
Unscored —
openSIS before 7.4 allows SQL Injection.
-
Unscored —
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack.…
-
Unscored —
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the da…