Archive
December 2020
Vulnerabilities first published in this month (UTC), newest first.
1,551 results · Feed
-
Unscored —
Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command executi…
-
Unscored —
Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
-
Unscored —
Exponent CMS before 2.6.0 has improper input validation in fileController.php.
-
Unscored —
Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
-
Unscored —
Exponent CMS before 2.6.0 has improper input validation in usersController.php.
-
Unscored —
Exponent CMS before 2.6.0 has improper input validation in storeController.php.
-
Unscored —
DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction…
-
Unscored —
USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or …
-
Unscored —
In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define()…
-
Unscored —
gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.…
-
Unscored —
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated informa…
-
High 7.5
Stack consumption in trust-dns-server
An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
-
High 7.5CVE-2020-13654 Public exploit
Improper escaping in XWiki Platform
XWiki Platform before 12.8 mishandles escaping in the property displayer.
-
Medium 6.5
Hostname spoofing in URI.js
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision m…
-
High 8.7
XSS in Vega
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Veg…
-
Medium 5.3
Path Traversal in Moby builder
util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.
-
Medium 5.3CVE-2020-28413 Public exploit
MantisBT SQL Injection via mc_project_get_users function
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.
-
Unscored —
On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will t…
-
Unscored —
JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.
-
Unscored —
In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and…
-
Unscored —
Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code…
-
Unscored —
An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING…
-
Unscored —
An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typ…
-
Unscored —
A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This…
-
Unscored —
An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The…
-
Unscored —
In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile informatio…
-
Unscored —
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a differ…
-
Unscored —
An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass a…
-
High 7.7
Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is …
-
Unscored —
The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP …
-
Medium 5.3
OS Command injection in Bolt
Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better Security" guidance.
-
High 8.8
Improper Restriction of XML External Entity Reference in Plone
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
-
High 8.8
SSRF attacks via tracebacks in Plone
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
-
High 8.8
Improper Restriction of XML External Entity Reference in Plone
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
-
Unscored —
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorO…
-
Unscored —
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the …
-
Unscored —
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the …
-
Unscored —
Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For…
-
Unscored —
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Pa…
-
High 7.5
MantisBT Incorrect Authorization for bug_revision_view_page.php check
An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential i…