Archive
9 December 2020
Vulnerabilities first published on this day (UTC), newest first.
130 results · Feed
-
Medium 5.5
Windows GDI+ Information Disclosure Vulnerability
Windows GDI+ Information Disclosure Vulnerability
-
High 7.5CVE-2020-17096 EPSS 20%
Windows NTFS Remote Code Execution Vulnerability
Windows NTFS Remote Code Execution Vulnerability
-
Low 3.3
Windows Digital Media Receiver Elevation of Privilege Vulnerability
Windows Digital Media Receiver Elevation of Privilege Vulnerability
-
Medium 5.5
Windows Error Reporting Information Disclosure Vulnerability
Windows Error Reporting Information Disclosure Vulnerability
-
High 8.5
Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
-
High 7.8
Windows Network Connections Service Elevation of Privilege Vulnerability
Windows Network Connections Service Elevation of Privilege Vulnerability
-
High 7.1
Microsoft SharePoint Elevation of Privilege Vulnerability
Microsoft SharePoint Elevation of Privilege Vulnerability
-
Medium 6.5
Kerberos Security Feature Bypass Vulnerability
Kerberos Security Feature Bypass Vulnerability
-
High 7.4
Azure SDK for C Security Feature Bypass Vulnerability
Azure SDK for C Security Feature Bypass Vulnerability
-
High 7.8
Windows Backup Engine Elevation of Privilege Vulnerability
Windows Backup Engine Elevation of Privilege Vulnerability
-
High 7.4
Azure SDK for Java Security Feature Bypass Vulnerability
Azure SDK for Java Security Feature Bypass Vulnerability
-
High 7.8
Windows Backup Engine Elevation of Privilege Vulnerability
Windows Backup Engine Elevation of Privilege Vulnerability
-
High 7.8
Windows Backup Engine Elevation of Privilege Vulnerability
Windows Backup Engine Elevation of Privilege Vulnerability
-
High 7.8
Windows Backup Engine Elevation of Privilege Vulnerability
Windows Backup Engine Elevation of Privilege Vulnerability
-
High 7.8
Windows Backup Engine Elevation of Privilege Vulnerability
Windows Backup Engine Elevation of Privilege Vulnerability
-
High 7.8
Windows Backup Engine Elevation of Privilege Vulnerability
Windows Backup Engine Elevation of Privilege Vulnerability
-
High 7.8
Windows Backup Engine Elevation of Privilege Vulnerability
Windows Backup Engine Elevation of Privilege Vulnerability
-
Medium 6.3
Database Security(DBS)-Use of a Broken or Risky Cryptographic Algorithm
Use of a Broken or Risky Cryptographic Algorithm vulnerability in McAfee Database Security Server and Sensor prior to 4.8.0 in the form of a SHA1 signed certificate that would allow an attacker on the same local network to potentially intercept communication …
-
High 7.8
Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect con…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feed…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php.
-
Unscored —
Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php.
-
Unscored —
A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page …
-
Unscored —
A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distribute…
-
Unscored —
A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distribute…
-
Unscored —
A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash…
-
Unscored —
A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid rea…
-
Unscored —
A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process…
-
Unscored —
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attac…
-
Medium 6.5
Denial of service attack via incorrect parameters to federation APIs
Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the p…
-
Unscored —
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the use…
-
Medium 5.5
Cortex XDR Agent: Exceptional condition denial-of-service (DoS)
An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition…
-
High 7.8
Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation
A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create…
-
Unscored —
A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_i…
-
Unscored —CVE-2020-29661 Public exploit
A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allow…
-
High 7.1
Cross-site Scripting (XSS)
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are conc…
-
High 8.2
Improper Authentication
This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as …
-
Unscored —
Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header
Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying and invalid fragmentation offset value specified in the IP header. This is only impacts bu…
-
Unscored —
Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of th…
-
Low 3.4CVE-2020-26836 Scanner template
SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading t…