Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
1,173 results · Feed
-
Unscored —
HUAWEI Mate 20 smartphones with 9.0.0.205(C00E205R2P1) have a logic error vulnerability. In a special scenario, the sys…
-
Unscored —
FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain paramet…
-
Critical 9.8
Prototype Pollution
All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
-
Critical 9.8
Prototype Pollution
All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
-
Unscored —
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc web…
-
Medium 6.8
IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform…
-
High 8.8CVE-2020-13941 Public exploit
Improper Input Validation in Apache Solr
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, r…
-
Medium 5.5CVE-2020-1493 Public exploit
Microsoft Outlook Information Disclosure Vulnerability
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific user…
-
Unscored —CVE-2020-24370 Public exploit
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by ge…
-
Unscored —
php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant…
-
Unscored —
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec.
-
Unscored —
A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker t…
-
Unscored —
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access t…
-
Unscored —
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker…
-
Unscored —
In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
-
Unscored —
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.
-
Unscored —
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.g…
-
Unscored —
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is pos…
-
Unscored —
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument c…
-
Unscored —CVE-2020-9767 Public exploit
A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who…
-
Medium 5.9
GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function
The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user kn…
-
Medium 6.7
Local privilege elevation in Composer-Setup for Windows
In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing `C:\ProgramData\ComposerSetup\bin\comp…
-
Low 3.0
Path Traversal in openapi-python-client
In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.
-
High 8.0
Arbitrary Code Generation
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
-
Unscored —
Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe…
-
Unscored —
A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary …
-
Medium 6.5
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …
KEV Nov 3, 2021 -
Unscored —
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All v…
-
Unscored —
A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login scree…
-
Unscored —
A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact …
-
Critical 9.8
Prototype Pollution
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
-
Critical 9.8
Prototype Pollution
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
-
Unscored —
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information,…
-
Unscored —
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information,…
-
Unscored —
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, …
-
Unscored —
ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service.
-
Unscored —
Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code…
-
Medium 6.1
Cross-site scripting vulnerability in TinyMCE
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.
-
Unscored —CVE-2019-6112 Scanner template
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allow…
-
Unscored —
There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web…