Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
1,173 results · Feed
-
Unscored —
A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31…
-
Unscored —
Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service i…
-
Unscored —
The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command tha…
-
Unscored —
Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentia…
-
Unscored —
Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unau…
-
Medium 6.5
Specific GeoQuery can cause DoS against MongoDB Server
A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoD…
-
Unscored —
The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol…
-
Unscored —
FusionCompute 8.0.0 has an information leak vulnerability. A module does not launch strict access control and informati…
-
Unscored —
HUAWEI P30 Pro smartphone with Versions earlier than 10.1.0.160(C00E160R2P8) has an integer overflow vulnerability. Som…
-
Unscored —
HUAWEI P30 Pro smartphones with Versions earlier than 10.1.0.160(C00E160R2P8) have an out of bound read vulnerability. …
-
Unscored —
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a c…
-
Unscored —
HUAWEI P30 smartphones with Versions earlier than 10.1.0.123(C431E22R2P5),Versions earlier than 10.1.0.123(C432E22R2P5)…
-
Unscored —
An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic fo…
-
Unscored —
An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messa…
-
Unscored —
VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication ser…
-
Unscored —
Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenario…
-
Medium 4.9
Philips SureSigns VS4 Improper Authentication
When an actor claims to have a given identity, Philips SureSigns VS4, A.07.107 and prior does not prove or insufficiently proves the claim is correct.
-
Medium 6.3
Philips SureSigns VS4 Improper Access Control
Philips SureSigns VS4, A.07.107 and prior does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
-
Low 2.1
Philips SureSigns VS4 Improper Input Validation
Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
-
Medium 5.3
Philips DreamMapper Insertion of Sensitive Information into Log File
Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker.
-
High 8.1
Sandbox Escape
This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
-
Medium 6.9
Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial installer
Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection (MTP) trial prior to 4.0.161.1 allows local users to change files that are part of write protection rules via manipulating symbolic links to redirect a McAfee file operation…
-
Unscored —
Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.
-
Unscored —
Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.
-
Unscored —
Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrat…
-
Unscored —
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgre…
-
Unscored —
The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local pr…
-
Unscored —
NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.
-
Unscored —
voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll fil…
-
Medium 6.2
Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate att…
-
Unscored —
eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. Th…
-
Unscored —
MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allow…
-
High 7.5
Improper Input Validation in vault-ssh-helper
HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.
-
Medium 4.3
IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that the…
-
Medium 4.3
IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. A malicious administrator could bypas…
-
Unscored —
In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privilege…
-
Unscored —
The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restr…
-
Unscored —
Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several e…
-
Unscored —
The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user suppli…
-
Unscored —
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: …