Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2009-5159 | 2 Invisioncommunity, Microsoft | 2 Invision Power Board, Internet Explorer | 2020-03-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment. | |||||
| CVE-2020-10544 | 1 Primetek | 1 Primefaces | 2020-03-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation. | |||||
| CVE-2020-9064 | 1 Huawei | 2 Honor V30, Honor V30 Firmware | 2020-03-18 | 2.1 LOW | 5.5 MEDIUM |
| Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak. | |||||
| CVE-2020-10575 | 1 Meetecho | 1 Janus | 2020-03-18 | 4.0 MEDIUM | 4.2 MEDIUM |
| An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times. | |||||
| CVE-2017-18350 | 1 Bitcoin | 1 Bitcoin Core | 2020-03-18 | 4.3 MEDIUM | 5.9 MEDIUM |
| bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled SOCKS proxy server is used. This results from an integer signedness error when the proxy server responds with an acknowledgement of an unexpected target domain name. | |||||
| CVE-2018-19516 | 1 Kde | 1 Kde Applications | 2020-03-18 | 5.0 MEDIUM | 5.3 MEDIUM |
| messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value. | |||||
| CVE-2020-10218 | 1 Sapplica | 1 Sentrifugo | 2020-03-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction function. | |||||
| CVE-2019-13170 | 1 Xerox | 2 Phaser 3320, Phaser 3320 Firmware | 2020-03-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device. | |||||
| CVE-2020-10078 | 1 Gitlab | 1 Gitlab | 2020-03-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability. | |||||
| CVE-2020-10076 | 1 Gitlab | 1 Gitlab | 2020-03-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests. | |||||
| CVE-2020-10577 | 1 Meetecho | 1 Janus | 2020-03-17 | 5.8 MEDIUM | 4.8 MEDIUM |
| An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session, leading to a race condition when claiming sessions. | |||||
| CVE-2020-10082 | 1 Gitlab | 1 Gitlab | 2020-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered. | |||||
| CVE-2020-10535 | 1 Gitlab | 1 Gitlab | 2020-03-17 | 4.3 MEDIUM | 5.3 MEDIUM |
| GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address. | |||||
| CVE-2019-16156 | 1 Fortinet | 1 Fortiweb | 2020-03-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthenticated attacker to perform a Cross Site Scripting attack (XSS). | |||||
| CVE-2020-10576 | 1 Meetecho | 1 Janus | 2020-03-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash. | |||||
| CVE-2020-10086 | 1 Gitlab | 1 Gitlab | 2020-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read. | |||||
| CVE-2020-10090 | 1 Gitlab | 1 Gitlab | 2020-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed. | |||||
| CVE-2019-2058 | 1 Google | 1 Android | 2020-03-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no additional execution privileges needed. User interaction is needed for exploitation.Product: Android Versions: Android-10 Android ID: A-136089102 | |||||
| CVE-2018-14476 | 1 Metalgenix | 1 Genixcms | 2020-03-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. | |||||
| CVE-2019-2088 | 1 Google | 1 Android | 2020-03-17 | 1.9 LOW | 5.5 MEDIUM |
| In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-143895055 | |||||
| CVE-2019-5176 | 1 Wago | 2 Pfc200, Pfc200 Firmware | 2020-03-17 | 2.1 LOW | 5.5 MEDIUM |
| An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x40 is overflowed with the call to sprintf() for any gateway values that are greater than 512-len(‘/etc/config-tools/config_default_gateway number=0 state=enabled value=‘) in length. A gateway value of length 0x7e2 will cause the service to crash. | |||||
| CVE-2019-5182 | 1 Wago | 2 Pfc200, Pfc200 Firmware | 2020-03-17 | 2.1 LOW | 5.5 MEDIUM |
| An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x440 is overflowed with the call to sprintf() for any type values that are greater than 1024-len(‘/etc/config-tools/config_interfaces interface=X1 state=enabled config-type=‘) in length. A type value of length 0x3d9 will cause the service to crash. | |||||
| CVE-2020-6643 | 1 Fortinet | 1 Fortiisolator | 2020-03-17 | 3.5 LOW | 5.4 MEDIUM |
| An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perform a cross site scripting attack (XSS). | |||||
| CVE-2018-10704 | 1 Yii2cmf Project | 1 Yii2cmf | 2020-03-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| yidashi yii2cmf 2.0 has XSS via the /search q parameter. | |||||
| CVE-2020-7253 | 1 Mcafee | 1 Agent | 2020-03-17 | 2.1 LOW | 4.4 MEDIUM |
| Improper access control vulnerability in masvc.exe in McAfee Agent (MA) prior to 5.6.4 allows local users with administrator privileges to disable self-protection via a McAfee supplied command-line utility. | |||||
| CVE-2020-0795 | 1 Microsoft | 3 Business Productivity Servers, Sharepoint Enterprise Server, Sharepoint Foundation | 2020-03-17 | 3.5 LOW | 5.4 MEDIUM |
| This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0891. | |||||
| CVE-2020-0891 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2020-03-17 | 3.5 LOW | 5.4 MEDIUM |
| This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0795. | |||||
| CVE-2020-0894 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2020-03-17 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0893. | |||||
| CVE-2020-0903 | 1 Microsoft | 1 Exchange Server | 2020-03-17 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'. | |||||
| CVE-2019-14625 | 1 Intel | 2 Field Programmable Gate Array Programmable Acceleration Card N3000, Field Programmable Gate Array Programmable Acceleration Card N3000 Firmware | 2020-03-17 | 2.1 LOW | 4.4 MEDIUM |
| Improper access control in on-card storage for the Intel® FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable denial of service via local access. | |||||
| CVE-2020-6858 | 1 Hotels | 1 Styx | 2020-03-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header. | |||||
| CVE-2019-9097 | 1 Moxa | 12 Mb3170, Mb3170 Firmware, Mb3180 and 9 more | 2020-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. A high rate of transit traffic may cause a low-memory condition and a denial of service. | |||||
| CVE-2019-4555 | 1 Ibm | 1 Cognos Analytics | 2020-03-17 | 3.5 LOW | 5.4 MEDIUM |
| IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 166204. | |||||
| CVE-2020-2100 | 1 Jenkins | 1 Jenkins | 2020-03-17 | 5.0 MEDIUM | 5.8 MEDIUM |
| Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848. | |||||
| CVE-2020-2101 | 1 Jenkins | 1 Jenkins | 2020-03-17 | 3.5 LOW | 5.3 MEDIUM |
| Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret. | |||||
| CVE-2020-2102 | 1 Jenkins | 1 Jenkins | 2020-03-17 | 3.5 LOW | 5.3 MEDIUM |
| Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC. | |||||
| CVE-2020-2103 | 1 Jenkins | 1 Jenkins | 2020-03-17 | 4.0 MEDIUM | 5.4 MEDIUM |
| Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. | |||||
| CVE-2020-2104 | 1 Jenkins | 1 Jenkins | 2020-03-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. | |||||
| CVE-2020-2105 | 1 Jenkins | 1 Jenkins | 2020-03-17 | 4.3 MEDIUM | 5.4 MEDIUM |
| REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. | |||||
| CVE-2012-5570 | 1 Basic Webmail Project | 1 Basic Webmail | 2020-03-16 | 4.0 MEDIUM | 4.3 MEDIUM |
| The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses. | |||||
| CVE-2020-10091 | 1 Gitlab | 1 Gitlab | 2020-03-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types. | |||||
| CVE-2020-0779 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2020-03-16 | 2.1 LOW | 5.5 MEDIUM |
| An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0798, CVE-2020-0814, CVE-2020-0842, CVE-2020-0843. | |||||
| CVE-2020-10387 | 1 Chadhaajay | 1 Phpkb | 2020-03-16 | 4.0 MEDIUM | 4.9 MEDIUM |
| Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence (../) via the GET parameter file. | |||||
| CVE-2020-0700 | 1 Microsoft | 2 Azure Devops Server, Team Foundation Server | 2020-03-16 | 3.5 LOW | 5.4 MEDIUM |
| A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'. | |||||
| CVE-2018-12992 | 1 Maelostore Project | 1 Maelostore | 2020-03-16 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface. | |||||
| CVE-2018-12658 | 1 Slims Project | 1 Slims | 2020-03-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI. | |||||
| CVE-2020-10092 | 1 Gitlab | 1 Gitlab | 2020-03-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration. | |||||
| CVE-2020-0893 | 1 Microsoft | 2 Sharepoint Enterprise Server, Sharepoint Server | 2020-03-16 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0894. | |||||
| CVE-2019-6190 | 1 Lenovo | 364 510-15ikl, 510-15ikl Firmware, 510s-08ikl and 361 more | 2020-03-16 | 2.1 LOW | 5.5 MEDIUM |
| Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled. | |||||
| CVE-2019-9288 | 1 Google | 1 Android | 2020-03-15 | 4.6 MEDIUM | 6.8 MEDIUM |
| In libhidcommand_jni, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the USB service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Android Versions: Android-10 Android ID: A-111363077 | |||||