Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
1,527 results · Feed
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that …
-
Unscored —
Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security per…
-
Medium 6.1
Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via User Name Parameter
Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, an…
-
Unscored —
An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure…
-
Unscored —CVE-2020-28672 EPSS 12%
MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution. At monofiles…
-
Unscored —
Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, aut…
-
Unscored —
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacter…
-
Unscored —
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video …
-
Unscored —
The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they…
-
Unscored —
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been u…
-
Unscored —
When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wro…
-
Unscored —
When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary heade…
-
Unscored —
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service w…
-
Unscored —
By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab w…
-
Unscored —
Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network…
-
Unscored —
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes c…
-
Unscored —
When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not trig…
-
Unscored —
If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there w…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corr…
-
Unscored —CVE-2020-24903 Scanner template
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user…
-
Medium 4.7CVE-2020-24902 Scanner template
Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied…
-
Medium 6.1
The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remo…
-
Unscored —
The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load …
-
Medium 6.1
Formstone Vulnerable to Reflected XSS
Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a spe…
-
Critical 9.9
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive informat…
-
High 8.8
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
-
High 8.8CVE-2020-36180 Public exploit
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
-
High 8.8
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
-
High 8.8CVE-2020-36184 Public exploit
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
-
High 8.1CVE-2020-36188 Public exploit
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
-
High 8.8
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.
-
Unscored —CVE-2020-25498 Public exploit
Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Tim…
-
Unscored —CVE-2020-35262 Public exploit
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date…
-
Medium 6.1CVE-2020-8264 EPSS 67%
Cross-site scripting in actionpack
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the contex…