Archive
13 August 2020
Vulnerabilities first published on this day (UTC), newest first.
112 results · Feed
-
Unscored —
ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privilege…
-
High 7.4
Philips SmartControl DLL Hijacking
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issu…
-
Unscored —
Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_c…
-
Unscored —
Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.
-
Unscored —
JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.
-
Unscored —
JerryScript through 2.3.0 allows stack consumption via function a(){new new Proxy(a,{})}JSON.parse("[]",a). NOTE: the v…
-
Unscored —
njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.
-
Unscored —
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.
-
Unscored —
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
-
Unscored —
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor con…
-
Unscored —
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by th…
-
Unscored —
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user st…
-
Unscored —
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of…
-
Unscored —
In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kaf…
-
Unscored —
In C2 flame devices, there is a possible bypass of seccomp due to a missing configuration file. This could lead to loca…
-
Unscored —
A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread…
-
Unscored —
A SQL injection vulnerability in the qm_adm/qm_export_stats_run.do endpoint of Loway QueueMetrics before 19.10.21 allow…
-
Unscored —
An issue was discovered on Spirent TestCenter and Avalanche appliance admin interface firmware. An attacker, who alread…
-
Unscored —
A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers …
-
Medium 6.4
For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Serve…
-
Medium 6.5
For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature
-
Medium 6.5
For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email e…
-
High 7.3
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference numb…
-
High 7.3
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone …
-
Low 3.1
For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access …
-
Unscored —
Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. …
-
Critical 9.8
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
KEV Dec 10, 2021 -
Unscored —
An issue was discovered in Zalo.exe in VNG Zalo Desktop 19.8.1.0. An attacker can run arbitrary commands on a remote Wi…
-
High 8.1
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the …
-
Medium 4.3
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An att…
-
Unscored —
Insufficient control flow management for some Intel(R) Wireless Bluetooth(R) products may allow an unprivileged user to…
-
Unscored —
Out-of-bounds read in kernel mode driver for some Intel(R) Wireless Bluetooth(R) products on Windows* 10, may allow a p…
-
Unscored —
Improper input validation for some Intel(R) Wireless Bluetooth(R) products may allow an authenticated user to potential…
-
Unscored —
Race condition in software installer for some Intel(R) Wireless Bluetooth(R) products on Windows* 7, 8.1 and 10 may all…
-
Unscored —
Insecure inherited permissions in some Intel(R) PROSet/Wireless WiFi products on Windows* 7 and 8.1 before version 21.4…
-
Unscored —
Improper input validation in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a …
-
Unscored —
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a pr…
-
Unscored —
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may al…
-
Unscored —
Improper buffer restrictions in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow…
-
Unscored —
Out of bounds read in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authen…