Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-15468 | 1 Persian Vip Download Script Project | 1 Persian Vip Download Script | 2020-07-07 | 7.5 HIGH | 9.8 CRITICAL |
| Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter. | |||||
| CVE-2019-20411 | 1 Atlassian | 2 Jira, Jira Software Data Center | 2020-07-07 | 4.3 MEDIUM | 4.3 MEDIUM |
| Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2. | |||||
| CVE-2020-10628 | 1 Honeywell | 4 Controledge Plc, Controledge Plc Firmware, Controledge Rtu and 1 more | 2020-07-07 | 5.0 MEDIUM | 7.5 HIGH |
| ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network. | |||||
| CVE-2020-10624 | 1 Honeywell | 4 Controledge Plc, Controledge Plc Firmware, Controledge Rtu and 1 more | 2020-07-07 | 5.0 MEDIUM | 7.5 HIGH |
| ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network. | |||||
| CVE-2019-19161 | 2 Cymiinstaller322 Activex Project, Microsoft | 4 Cymiinstaller322 Activex, Windows 10, Windows 7 and 1 more | 2020-07-07 | 6.5 MEDIUM | 7.2 HIGH |
| CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability in downloading files by CyMiInstaller322 ActiveX caused by an attacker to download randomly generated DLL files and MIPLATFORM to load those DLLs due to insufficient verification. | |||||
| CVE-2020-15401 | 1 Iobit | 1 Malware Fighter | 2020-07-07 | 2.1 LOW | 4.4 MEDIUM |
| IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations with an NTFS junction and an Object Manager symbolic link. | |||||
| CVE-2020-14940 | 1 Herac | 1 Tuxguitar | 2020-07-07 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files. | |||||
| CVE-2020-4363 | 3 Ibm, Linux, Microsoft | 3 Db2, Linux Kernel, Windows | 2020-07-07 | 7.2 HIGH | 7.8 HIGH |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 178960. | |||||
| CVE-2019-7314 | 2 Debian, Live555 | 2 Debian Linux, Streaming Media | 2020-07-07 | 7.5 HIGH | 9.8 CRITICAL |
| liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact. | |||||
| CVE-2020-14006 | 1 Solarwinds | 2 Orion Network Performance Monitor, Orion Web Performance Monitor | 2020-07-07 | 3.5 LOW | 5.4 MEDIUM |
| Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team. | |||||
| CVE-2020-14007 | 1 Solarwinds | 2 Orion Network Performance Monitor, Orion Web Performance Monitor | 2020-07-07 | 3.5 LOW | 5.4 MEDIUM |
| Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition. | |||||
| CVE-2020-4386 | 3 Ibm, Linux, Microsoft | 3 Db2, Linux Kernel, Windows | 2020-07-07 | 1.9 LOW | 4.7 MEDIUM |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179268. | |||||
| CVE-2020-4387 | 3 Ibm, Linux, Microsoft | 3 Db2, Linux Kernel, Windows | 2020-07-07 | 1.9 LOW | 4.7 MEDIUM |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269. | |||||
| CVE-2020-4420 | 3 Ibm, Linux, Microsoft | 3 Db2, Linux Kernel, Windows | 2020-07-07 | 5.0 MEDIUM | 7.5 HIGH |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of service due a hang in the execution of a terminate command. IBM X-Force ID: 180076. | |||||
| CVE-2018-6446 | 1 Broadcom | 1 Brocade Network Advisor | 2020-07-07 | 7.5 HIGH | 9.8 CRITICAL |
| A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications. | |||||
| CVE-2020-13381 | 1 Os4ed | 1 Opensis | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| openSIS through 7.4 allows SQL Injection. | |||||
| CVE-2020-13383 | 1 Os4ed | 1 Opensis | 2020-07-06 | 5.0 MEDIUM | 7.5 HIGH |
| openSIS through 7.4 allows Directory Traversal. | |||||
| CVE-2020-14980 | 1 Sophos | 1 Sophos Secure Email | 2020-07-06 | 4.3 MEDIUM | 5.9 MEDIUM |
| The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation. | |||||
| CVE-2020-14981 | 1 Vipre | 1 Password Vault | 2020-07-06 | 4.3 MEDIUM | 5.9 MEDIUM |
| The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation. | |||||
| CVE-2020-2205 | 1 Jenkins | 1 Vncrecorder | 2020-07-06 | 3.5 LOW | 4.8 MEDIUM |
| Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators. | |||||
| CVE-2020-2207 | 1 Jenkins | 1 Vncviewer | 2020-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability. | |||||
| CVE-2018-17874 | 1 Expressionengine | 1 Expressionengine | 2020-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| ExpressionEngine before 4.3.5 has reflected XSS. | |||||
| CVE-2020-2211 | 1 Jenkins | 1 Kubernetes Ci | 2020-07-06 | 6.5 MEDIUM | 8.8 HIGH |
| Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. | |||||
| CVE-2017-1000160 | 1 Expressionengine | 1 Expressionengine | 2020-07-06 | 3.5 LOW | 5.4 MEDIUM |
| EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection | |||||
| CVE-2014-5387 | 2 Ellislab, Expressionengine | 2 Expressionengine, Expressionengine | 2020-07-06 | 6.5 MEDIUM | N/A |
| Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php. | |||||
| CVE-2020-15475 | 1 Ntop | 1 Ndpi | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free. | |||||
| CVE-2020-15474 | 1 Ntop | 1 Ndpi | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. | |||||
| CVE-2018-6494 | 1 Microfocus | 1 Service Manager | 2020-07-06 | 5.5 MEDIUM | 5.4 MEDIUM |
| Remote SQL Injection against the HP Service Manager Software Web Tier, version 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, may lead to unauthorized disclosure of data. | |||||
| CVE-2020-15473 | 1 Ntop | 1 Ndpi | 2020-07-06 | 6.4 MEDIUM | 9.1 CRITICAL |
| In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c. | |||||
| CVE-2020-15472 | 1 Ntop | 1 Ndpi | 2020-07-06 | 6.4 MEDIUM | 9.1 CRITICAL |
| In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short. | |||||
| CVE-2020-2219 | 1 Jenkins | 1 Link Column | 2020-07-06 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability. | |||||
| CVE-2020-15471 | 1 Ntop | 1 Ndpi | 2020-07-06 | 6.4 MEDIUM | 9.1 CRITICAL |
| In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c. | |||||
| CVE-2020-15365 | 1 Libraw | 1 Libraw | 2020-07-06 | 4.3 MEDIUM | 6.5 MEDIUM |
| LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds. | |||||
| CVE-2020-4061 | 1 Octobercms | 1 October | 2020-07-06 | 3.5 LOW | 5.4 MEDIUM |
| In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467. | |||||
| CVE-2020-15351 | 2 Idrive, Microsoft | 2 Idrive, Windows | 2020-07-06 | 7.2 HIGH | 7.8 HIGH |
| IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions granting any user modify permission (i.e., NT AUTHORITY\Authenticated Users:(OI)(CI)(M)) to the contents of the directory and its sub-folders. In addition, the program installs a service called IDriveService that runs as LocalSystem. Thus, any standard user can escalate privileges to NT AUTHORITY\SYSTEM by substituting the service's binary with a malicious one. | |||||
| CVE-2020-15043 | 1 Iball | 2 Wrb303n, Wrb303n Firmware | 2020-07-06 | 4.3 MEDIUM | 6.5 MEDIUM |
| iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses. | |||||
| CVE-2020-14414 | 1 Nedi | 1 Nedi | 2020-07-06 | 9.0 HIGH | 8.8 HIGH |
| NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a pw parameter. (This can also be exploited via CSRF.) | |||||
| CVE-2020-14412 | 1 Nedi | 1 Nedi | 2020-07-06 | 9.0 HIGH | 8.8 HIGH |
| NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a psw parameter. (This can also be exploited via CSRF.) | |||||
| CVE-2020-7355 | 1 Rapid7 | 1 Metasploit | 2020-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7354, which describes a similar issue, but involving the generated 'host' field of a discovered scan asset. | |||||
| CVE-2020-15323 | 1 Zyxel | 1 Cloudcnm Secumanager | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials. | |||||
| CVE-2020-14413 | 1 Nedi | 1 Nedi | 2020-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value. | |||||
| CVE-2020-15322 | 1 Zyxel | 1 Cloudcnm Secumanager | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account. | |||||
| CVE-2013-7489 | 1 Beakerbrowser | 1 Beaker | 2020-07-06 | 5.2 MEDIUM | 6.8 MEDIUM |
| The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution. | |||||
| CVE-2020-15318 | 1 Zyxel | 1 Cloudcnm Secumanager | 2020-07-06 | 4.3 MEDIUM | 5.9 MEDIUM |
| Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree. | |||||
| CVE-2020-15321 | 1 Zyxel | 1 Cloudcnm Secumanager | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account. | |||||
| CVE-2020-15317 | 1 Zyxel | 1 Cloudcnm Secumanager | 2020-07-06 | 4.3 MEDIUM | 5.9 MEDIUM |
| Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree. | |||||
| CVE-2018-21268 | 1 Traceroute Project | 1 Traceroute | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character. | |||||
| CVE-2020-15316 | 1 Zyxel | 1 Cloudcnm Secumanager | 2020-07-06 | 4.3 MEDIUM | 5.9 MEDIUM |
| Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree. | |||||
| CVE-2020-9437 | 1 Secureauth | 1 Secureauth Identity Provider | 2020-07-06 | 3.5 LOW | 4.8 MEDIUM |
| SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS. | |||||
| CVE-2020-15315 | 1 Zyxel | 1 Cloudcnm Secumanager | 2020-07-06 | 4.3 MEDIUM | 5.9 MEDIUM |
| Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree. | |||||