Archive
15 December 2020
Vulnerabilities first published on this day (UTC), newest first.
129 results · Feed
-
Unscored —
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System u…
-
Unscored —
The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed …
-
Unscored —
The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected ver…
-
Unscored —
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using aff…
-
Unscored —
The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affec…
-
Unscored —
Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using…
-
Unscored —
Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed usi…
-
Unscored —
Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using af…
-
Unscored —
SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, rela…
-
Unscored —
Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically …
-
Unscored —
An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could i…
-
Unscored —
An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could b…
-
Unscored —CVE-2020-35416 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php adm…
-
Unscored —
A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker …
-
Unscored —
Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated b…
-
High 7.5
Denial of Service in jsonparser
jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.
-
High 7.5
Denial of service in GJSON
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
-
Unscored —
The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on …
-
Unscored —
An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interf…
-
Unscored —
An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could a…
-
Unscored —
A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input bein…
-
Unscored —
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redire…
-
Unscored —
An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a…
-
Medium 6.5
TIBCO PartnerExpress REST API
The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains a vulnerability that theoretically allows an unauthenticated attacker with network access to obtain an authenticated login URL for the affected system via a REST API. Affected relea…
-
Unscored —
An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing g…
-
Unscored —
An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are t…
-
Unscored —
An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking …
-
Unscored —
An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the wat…
-
Unscored —
An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specif…
-
Unscored —
An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full p…
-
Unscored —
An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reportin…
-
Unscored —
An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of th…
-
Unscored —
An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO …
-
Unscored —
An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and th…
-
Unscored —
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block …
-
Unscored —
A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usuall…
-
Unscored —
A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege …
-
Unscored —
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch even…
-
Unscored —
An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vector…
-
Unscored —
An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must …