Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
1,428 results · Feed
-
Unscored —
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or Jav…
-
Unscored —
Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.
-
Unscored —
A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.
-
Unscored —
There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execut…
-
Unscored —
Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restri…
-
Unscored —
There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE…
-
Unscored —
Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.
-
Unscored —
There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is re…
-
High 7.8
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick chara…
-
Medium 6.5
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where Ses…
-
Unscored —
A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could a…
-
Unscored —
A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could all…
-
Unscored —
A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and olde…
-
Unscored —
A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and pr…
-
Unscored —
A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and…
-
Unscored —
A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 an…
-
Unscored —
**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 …
-
Unscored —
A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Upda…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 8.0
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
Unscored —
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD In…
-
Unscored —
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD In…
-
Unscored —
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD In…
-
Unscored —
An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe w…
-
Unscored —
The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters …
-
Critical 9.8
DevSpace vulnerable to remote code execution
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.
-
Unscored —
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute ar…
-
Medium —
Storing Password in Local Storage
The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time tha…
-
Unscored —
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
-
Unscored —CVE-2020-15916 Public exploit
goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary syste…
-
Medium 5.5
Kubernetes node disk Denial of Service by writing to container /etc/hosts
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction m…
-
Medium 5.4
IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to e…
-
Unscored —
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3…
-
High 7.5
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE …
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmwa…
-
Critical 9.8
This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware versi…
-
Medium 5.9
This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA…
-
High 7.5
This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmwar…
-
Medium 5.9
Credential leakage when failing to mount
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.