Skip to content
OpenAdvisories

Archive

14 September 2020

Vulnerabilities first published on this day (UTC), newest first.

← August 2020 2020 / September /14 October 2020 →
  1. 1192
  2. 2134
  3. 3364
  4. 4123
  5. 51
  6. 6 
  7. 7 
  8. 852
  9. 9124
  10. 1043
  11. 11223
  12. 12 
  13. 136
  14. 1460
  15. 1553
  16. 1682
  17. 17138
  18. 18105
  19. 1912
  20. 20 
  21. 2158
  22. 2234
  23. 2376
  24. 2499
  25. 25112
  26. 26 
  27. 2711
  28. 2810
  29. 2939
  30. 3054
All Critical High Medium Low Exploited only Public exploit

60 results · Feed

  • High 7.5
    CVE-2019-0233 EPSS 66%

    Improper Preservation of Permissions in Apache Struts

    An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

    org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2019-0230 Public exploit Scanner template EPSS 97%

    Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

    Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

    org.apache.struts:struts2-core Maven
  • Unscored —
    CVE-2020-25380

    Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Reca…

    Web / CMS
  • Unscored —
    CVE-2020-25379

    Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parame…

    Web / CMS
  • Unscored —
    CVE-2020-25378

    Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the …

    Web / CMS
  • Unscored —
    CVE-2020-22158

    MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker ha…

  • Unscored —
    CVE-2020-25375

    Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name…

    Web / CMS
  • Unscored —
    CVE-2020-8817

    Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata.

  • Unscored —
    CVE-2018-20432

    D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows …

  • Unscored —
    CVE-2020-11684

    AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control…

  • Unscored —
    CVE-2020-11683

    A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical acce…

  • Unscored —
    CVE-2020-12789

    The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.

  • Unscored —
    CVE-2020-12788

    CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power ana…

  • Unscored —
    CVE-2020-12787

    Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to app…

  • Medium 6.5
    CVE-2020-24660

    Lack of URL normalization may lead to authorization bypass when URL access rules are used

    An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler fo…

    lemonldap-ng lemonldap-ng lemonldap-ng-handler Debian Ubuntu npm
  • High 7.5
    CVE-2020-25540 Public exploit Scanner template EPSS 75%

    ThinkAdmin directory traversal vulnerability

    ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.

    zoujingli/thinkadmin Packagist
  • Medium 5.6
    CVE-2020-7807

    DLL Hijacking Vulnerabilities During Installation of LG Electronics Software

    A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in ____COMPONENT__…

    LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup)
  • Unscored —
    CVE-2020-21733

    Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.

  • Unscored —
    CVE-2020-21732

    Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code …

  • Unscored —
    CVE-2020-21731

    Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?us…