Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
1,173 results · Feed
-
Unscored —
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6…
-
Unscored —
In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged ro…
-
Unscored —
In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile …
-
High 8.2
HashiCorp Vault Authentication bypass
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.
-
High 8.2
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
-
Unscored —
In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-…
-
Unscored —
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6…
-
Unscored —
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6…
-
Unscored —
In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client …
-
Unscored —
Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerabil…
-
Unscored —
Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.
-
Unscored —
Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in m…
-
Critical 9.6
HMS Industrial Networks AB eCatcher Stack-based Buffer Overflow
HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
-
Unscored —
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supp…
-
Unscored —
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it…
-
Unscored —
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to…
-
Unscored —
Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoi…
-
Unscored —
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the val…
-
Unscored —
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htacc…
-
Unscored —
An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. The router accepts an arbitrary server cer…
-
Unscored —
An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. They allow XSS via spoofed Release Notes o…
-
Unscored —
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.
-
Low 3.9
Cross Site Scripting vulnerability in ePO extension of MACC
Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.
-
Unscored —CVE-2020-24656 Public exploit
Maltego before 4.2.12 allows XXE attacks.
-
Medium —
Expo on iOS is insecure due incorrect security attribute application
secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
-
High 7.3
OS Command Injection and Improper Input Validation in ansible
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take ad…
-
Unscored —
zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can…
-
High 7.8
Maven Extension plugin for Gradle Enterprise vulnerable to Deserialization of Untrusted Data
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execu…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 8.8CVE-2020-17389 EPSS 10%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8CVE-2020-17387 EPSS 10%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8CVE-2020-15645 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8CVE-2020-15643 EPSS 59%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marv…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConv…
-
Critical 9.8CVE-2020-15639 EPSS 12%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConv…