Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-4790 | 1 Pulsesecure | 1 Pulse Connect Secure | 2020-04-29 | 3.5 LOW | 5.5 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2018-14366 | 1 Pulsesecure | 2 Pulse Connect Secure, Pulse Policy Secure | 2020-04-29 | 5.8 MEDIUM | 6.1 MEDIUM |
| download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability. | |||||
| CVE-2019-11543 | 1 Pulsesecure | 2 Pulse Connect Secure, Pulse Policy Secure | 2020-04-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1. | |||||
| CVE-2020-5279 | 1 Prestashop | 1 Prestashop | 2020-04-29 | 6.4 MEDIUM | 6.5 MEDIUM |
| In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5 | |||||
| CVE-2020-11007 | 1 Shopizer | 1 Shopizer | 2020-04-29 | 4.0 MEDIUM | 6.5 MEDIUM |
| In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0. | |||||
| CVE-2020-3260 | 1 Cisco | 12 Aironet 1542d, Aironet 1542d Firmware, Aironet 1542i and 9 more | 2020-04-29 | 3.3 LOW | 6.5 MEDIUM |
| A vulnerability in Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of client packets that are sent to an affected access point (AP). An attacker could exploit this vulnerability by sending a large number of sustained client packets to the affected AP. A successful exploit could allow the attacker to cause the affected AP to crash, resulting in a DoS condition. | |||||
| CVE-2020-2177 | 1 Jenkins | 1 Copr | 2020-04-29 | 4.0 MEDIUM | 4.3 MEDIUM |
| Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. | |||||
| CVE-2017-6192 | 1 Apng Disassembler Project | 1 Apng Disassembler | 2020-04-29 | 4.3 MEDIUM | 5.5 MEDIUM |
| Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute arbitrary code via a crafted image containing a malformed chunk size descriptor. | |||||
| CVE-2017-6193 | 1 Apng Disassembler Project | 1 Apng Disassembler | 2020-04-29 | 6.8 MEDIUM | 5.5 MEDIUM |
| Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted image containing a malformed image size descriptor in the IHDR chunk. | |||||
| CVE-2020-10935 | 1 Zulip | 1 Zulip Server | 2020-04-28 | 3.5 LOW | 5.4 MEDIUM |
| Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover. | |||||
| CVE-2020-9444 | 1 Zulip | 1 Zulip Server | 2020-04-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality. | |||||
| CVE-2020-11649 | 1 Gitlab | 1 Gitlab | 2020-04-28 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted. | |||||
| CVE-2020-5721 | 1 Mikrotik | 1 Winbox | 2020-04-28 | 2.1 LOW | 5.5 MEDIUM |
| MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuration file can extract a username and password to gain access to the router. | |||||
| CVE-2019-12001 | 1 Hpe | 12 Msa 1040, Msa 1040 Firmware, Msa 1050 and 9 more | 2020-04-28 | 7.1 HIGH | 6.4 MEDIUM |
| A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage version(s): GL225P001 and earlier; GL225P001 and earlier; VE270R001-01 and earlier; GL225P001 and earlier; VL270R001-01 and earlier; VL270R001-01 and earlier. | |||||
| CVE-2017-18811 | 1 Netgear | 1 Readynas Os | 2020-04-28 | 3.5 LOW | 4.8 MEDIUM |
| NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. | |||||
| CVE-2017-18812 | 1 Netgear | 1 Readynas Os | 2020-04-28 | 3.5 LOW | 4.8 MEDIUM |
| NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. | |||||
| CVE-2017-18813 | 1 Netgear | 1 Readynas Os | 2020-04-28 | 3.5 LOW | 4.8 MEDIUM |
| NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. | |||||
| CVE-2017-18809 | 1 Netgear | 1 Readynas Os | 2020-04-28 | 3.5 LOW | 4.8 MEDIUM |
| NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. | |||||
| CVE-2020-12129 | 1 App2pro | 1 Airdisk Pro | 2020-04-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function. | |||||
| CVE-2020-12130 | 1 App2pro | 1 Airdisk Pro | 2020-04-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function. | |||||
| CVE-2020-12131 | 1 App2pro | 1 Airdisk Pro | 2020-04-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo). | |||||
| CVE-2017-18700 | 1 Netgear | 46 D6400, D6400 Firmware, D7000 and 43 more | 2020-04-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Certain NETGEAR devices are affected by stored XSS. This affects D6400 before 1.0.0.60, D7000 before 1.0.1.50, D8500 before 1.0.3.29, EX6200 before 1.0.3.84, EX7000 before 1.0.0.60, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 before 1.0.1.34, R6900P before 1.3.0.8, R7000 before 1.0.9.14, R7000P before 1.3.0.8, R7100LG before 1.0.0.34, R7300DST before 1.0.0.56, R7900 before 1.0.1.26, R8000 before 1.0.4.4, R8300 before 1.0.2.106, R8500 before 1.0.2.106, R9000 before 1.0.2.52, WNDR3400v3 before 1.0.1.16, WNR3500Lv2 before 1.2.0.46, and WNDR3700v5 before 1.1.0.48. | |||||
| CVE-2017-18715 | 1 Netgear | 14 Ex3700, Ex3700 Firmware, Ex3800 and 11 more | 2020-04-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Certain NETGEAR devices are affected by reflected XSS. This affects EX3700 before 1.0.0.66, EX3800 before 1.0.0.66, EX6100 before 1.0.2.20, EX6120 before 1.0.0.34, EX6150 before 1.0.0.36, EX6200 before 1.0.3.84, and EX7000 before 1.0.0.60. | |||||
| CVE-2017-18704 | 1 Netgear | 36 D6220, D6220 Firmware, D6400 and 33 more | 2020-04-28 | 3.3 LOW | 6.5 MEDIUM |
| Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D6220 before 1.0.0.32, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 before 1.0.1.34, R7000 before 1.0.9.14, R7000P before 1.3.0.8, R6900P before 1.3.0.8, R7100LG before 1.0.0.34, R7300DST before 1.0.0.56, R7900 before 1.0.1.26, R8000 before 1.0.4.4, R8500 before 1.0.2.106, R8300 before 1.0.2.106, and WNDR3400v3 before 1.0.1.16. | |||||
| CVE-2018-21228 | 1 Netgear | 26 D7800, D7800 Firmware, Ex6100 and 23 more | 2020-04-28 | 5.2 MEDIUM | 6.8 MEDIUM |
| Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, EX6100v2 before 1.0.1.50, EX6150v2 before 1.0.1.50, EX6200v2 before 1.0.1.44, EX6400 before 1.0.1.60, EX7300 before 1.0.1.60, R6100 before 1.0.1.16, R7500 before 1.0.0.110, R7800 before 1.0.2.32, R9000 before 1.0.2.30, WN3000RPv3 before 1.0.2.50, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50. | |||||
| CVE-2017-18697 | 1 Netgear | 4 R7800, R7800 Firmware, R9000 and 1 more | 2020-04-28 | 5.2 MEDIUM | 6.8 MEDIUM |
| Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40 and R9000 before 1.0.2.52. | |||||
| CVE-2017-18698 | 1 Netgear | 6 R6100, R6100 Firmware, R7800 and 3 more | 2020-04-28 | 5.2 MEDIUM | 6.8 MEDIUM |
| Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6100 before 1.0.1.20, R7800 before 1.0.2.40, and R9000 before 1.0.2.52. | |||||
| CVE-2017-18699 | 1 Netgear | 4 R7800, R7800 Firmware, R9000 and 1 more | 2020-04-28 | 5.2 MEDIUM | 6.8 MEDIUM |
| Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40 and R9000 before 1.0.2.52. | |||||
| CVE-2018-3619 | 1 Intel | 17 Core I3, Core I5, Core I7 and 14 more | 2020-04-28 | 2.1 LOW | 4.6 MEDIUM |
| Information disclosure vulnerability in storage media in systems with Intel Optane memory module with Whole Disk Encryption may allow an attacker to recover data via physical access. | |||||
| CVE-2017-18701 | 1 Netgear | 4 R6700, R6700 Firmware, R6900 and 1 more | 2020-04-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34. | |||||
| CVE-2019-20789 | 1 Croogo | 1 Croogo | 2020-04-27 | 3.5 LOW | 4.8 MEDIUM |
| Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies. | |||||
| CVE-2018-21129 | 1 Netgear | 4 Wac505, Wac505 Firmware, Wac510 and 1 more | 2020-04-27 | 3.3 LOW | 6.5 MEDIUM |
| Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17. | |||||
| CVE-2018-21095 | 1 Netgear | 4 Srr60, Srr60 Firmware, Srs60 and 1 more | 2020-04-27 | 2.3 LOW | 4.3 MEDIUM |
| Certain NETGEAR devices are affected by stored XSS. This affects SRR60 before 2.2.1.210 and SRS60 before 2.2.1.210. | |||||
| CVE-2018-21098 | 1 Netgear | 2 R7800, R7800 Firmware | 2020-04-27 | 5.2 MEDIUM | 6.8 MEDIUM |
| NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user. | |||||
| CVE-2020-9445 | 1 Zulip | 1 Zulip Server | 2020-04-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality. | |||||
| CVE-2019-4668 | 1 Ibm | 1 Urbancode Deploy | 2020-04-27 | 2.1 LOW | 5.5 MEDIUM |
| IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250. | |||||
| CVE-2020-5287 | 1 Prestashop | 1 Prestashop | 2020-04-27 | 6.4 MEDIUM | 6.5 MEDIUM |
| In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5. | |||||
| CVE-2020-5288 | 1 Prestashop | 1 Prestashop | 2020-04-27 | 6.4 MEDIUM | 6.5 MEDIUM |
| "In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5. | |||||
| CVE-2019-10523 | 1 Qualcomm | 46 Apq8009, Apq8009 Firmware, Apq8053 and 43 more | 2020-04-27 | 2.1 LOW | 5.5 MEDIUM |
| Target specific data is being sent to remote server and leads to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, QCA6574AU, QCS605, Rennell, SDA660, SDM429W, SDM439, SDM450, SDM710, SDM845, SM7150, SM8150, SM8250, SXR2130 | |||||
| CVE-2020-5293 | 1 Prestashop | 1 Prestashop | 2020-04-27 | 6.4 MEDIUM | 6.5 MEDIUM |
| In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5. | |||||
| CVE-2020-12071 | 1 Anchorcms | 1 Anchor | 2020-04-27 | 3.5 LOW | 4.8 MEDIUM |
| Anchor 0.12.7 allows admins to cause XSS via crafted post content. | |||||
| CVE-2020-11416 | 1 Jetbrains | 1 Space | 2020-04-27 | 3.5 LOW | 5.4 MEDIUM |
| JetBrains Space through 2020-04-22 allows stored XSS in Chats. | |||||
| CVE-2020-11689 | 1 Jetbrains | 1 Teamcity | 2020-04-27 | 4.0 MEDIUM | 6.5 MEDIUM |
| In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file. | |||||
| CVE-2017-18790 | 1 Netgear | 12 R6700, R6700 Firmware, R7000 and 9 more | 2020-04-27 | 2.1 LOW | 6.2 MEDIUM |
| Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R6700 before 1.0.1.26, R7000 before 1.0.9.10, R7100LG before 1.0.0.32, R7900 before 1.0.1.18, R8000 before 1.0.3.54, and R8500 before 1.0.2.100. | |||||
| CVE-2017-18797 | 1 Netgear | 8 R6400, R6400 Firmware, R7900 and 5 more | 2020-04-27 | 2.1 LOW | 6.2 MEDIUM |
| Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects R6400 before 1.0.1.24, R7900 before 1.0.1.18, R8000 before 1.0.3.54, and R8500 before 1.0.2.100. | |||||
| CVE-2018-21143 | 1 Netgear | 2 Gs810emx, Gs810emx Firmware | 2020-04-27 | 3.3 LOW | 6.5 MEDIUM |
| NETGEAR GS810EMX devices before 1.0.0.5 are affected by disclosure of sensitive information. | |||||
| CVE-2018-21144 | 1 Netgear | 18 Dm200, Dm200 Firmware, R7500 and 15 more | 2020-04-27 | 5.2 MEDIUM | 6.8 MEDIUM |
| Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects DM200 before 1.0.0.52, R7500 before 1.0.0.122, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.16, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64. | |||||
| CVE-2018-21145 | 1 Netgear | 22 D7800, D7800 Firmware, Dm200 and 19 more | 2020-04-27 | 5.2 MEDIUM | 6.8 MEDIUM |
| Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.50, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64. | |||||
| CVE-2018-21111 | 1 Netgear | 20 D3600, D3600 Firmware, D6000 and 17 more | 2020-04-27 | 5.2 MEDIUM | 6.8 MEDIUM |
| Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6100 before 1.0.0.60, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300 before 1.0.2.104, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, and WNR2000v5 before 1.0.0.66. | |||||
| CVE-2017-18765 | 1 Netgear | 12 R6300, R6300 Firmware, R6400 and 9 more | 2020-04-27 | 3.3 LOW | 6.5 MEDIUM |
| Certain NETGEAR devices are affected by denial of service. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.22, R6400v2 before 1.0.2.32, R6700 before 1.0.1.20, R6900 before 1.0.1.20, WNR3500Lv2 before 1.2.0.44, and WNR2000v2 before 1.2.0.8. | |||||