| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-7523 | Med | 0.35 | 6.5 | 0.03 | Feb 6, 2020 | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. | ||
| CVE-2015-6000 | Hig | 0.63 | 8.8 | 0.40 | Feb 6, 2020 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an… | ||
| CVE-2012-2593 | Med | 0.43 | 6.1 | 0.06 | Feb 6, 2020 | Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email. | ||
| CVE-2010-3917 | Med | 0.42 | 6.5 | 0.01 | Feb 6, 2020 | Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site. | ||
| CVE-2020-5528 | Med | 0.40 | 6.1 | 0.01 | Feb 6, 2020 | Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier… | ||
| CVE-2020-8658 | Hig | 0.58 | 8.8 | 0.10 | Feb 6, 2020 | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of… | ||
| CVE-2019-20406 | Hig | 0.51 | 7.8 | 0.00 | Feb 6, 2020 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable… | ||
| CVE-2019-20405 | Med | 0.28 | 4.3 | 0.01 | Feb 6, 2020 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability. | ||
| CVE-2019-20404 | Med | 0.28 | 4.3 | 0.01 | Feb 6, 2020 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability. | ||
| CVE-2019-20403 | Med | 0.35 | 5.3 | 0.01 | Feb 6, 2020 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability. | ||
| CVE-2019-20402 | Med | 0.32 | 4.9 | 0.01 | Feb 6, 2020 | Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability. | ||
| CVE-2019-20401 | Med | 0.42 | 6.5 | 0.01 | Feb 6, 2020 | Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities. | ||
| CVE-2019-20400 | Hig | 0.51 | 7.8 | 0.00 | Feb 6, 2020 | The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability. | ||
| CVE-2019-20106 | Med | 0.28 | 4.3 | 0.01 | Feb 6, 2020 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control… | ||
| CVE-2019-20104 | Hig | 0.49 | 7.5 | 0.02 | Feb 6, 2020 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. | ||
| CVE-2020-8649 | Med | 0.38 | 5.9 | 0.00 | Feb 6, 2020 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. | ||
| CVE-2020-8648 | Hig | 0.46 | 7.1 | 0.01 | Feb 6, 2020 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. | ||
| CVE-2020-8647 | Med | 0.40 | 6.1 | 0.00 | Feb 6, 2020 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. | ||
| CVE-2011-1597 | Hig | 0.57 | 8.8 | 0.02 | Feb 6, 2020 | OpenVAS Manager v2.0.3 allows plugin remote code execution. | ||
| CVE-2011-1517 | Cri | 0.64 | 9.8 | 0.04 | Feb 5, 2020 | SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet, an attacker could exploit this vulnerability to cause the application to crash. | ||
| CVE-2020-8644 | Cri | 0.79 | 9.8 | 0.87 | KEV | Feb 5, 2020 | PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. | |
| CVE-2011-1151 | Cri | 0.59 | 9.1 | 0.02 | Feb 5, 2020 | Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters. | ||
| CVE-2011-1150 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter. | ||
| CVE-2020-8641 | Hig | 0.58 | 8.8 | 0.12 | Feb 5, 2020 | Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter. | ||
| CVE-2020-6854 | Med | 0.35 | 5.4 | 0.01 | Feb 5, 2020 | A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API. | ||
| CVE-2013-2682 | Med | 0.31 | 4.3 | 0.06 | Feb 5, 2020 | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information. | ||
| CVE-2013-2681 | Cri | 0.68 | 9.8 | 0.10 | Feb 5, 2020 | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access. | ||
| CVE-2013-2680 | Hig | 0.52 | 7.5 | 0.09 | Feb 5, 2020 | Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information. | ||
| CVE-2011-1069 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | PHPShop through 0.8.1 has XSS. | ||
| CVE-2011-1009 | Med | 0.33 | 6.1 | 0.01 | Feb 5, 2020 | Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter. | ||
| CVE-2011-0525 | Hig | 0.57 | 8.8 | 0.01 | Feb 5, 2020 | Batavi before 1.0 has CSRF. | ||
| CVE-2019-20447 | Cri | 0.64 | 9.8 | 0.02 | Feb 5, 2020 | Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint. | ||
| CVE-2019-20173 | Med | 0.40 | 6.1 | 0.02 | Feb 5, 2020 | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. | ||
| CVE-2011-0220 | Med | 0.36 | 5.5 | 0.00 | Feb 5, 2020 | Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet. | ||
| CVE-2010-5304 | Hig | 0.49 | 7.5 | 0.03 | Feb 5, 2020 | A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client. | ||
| CVE-2015-5628 | Cri | 0.64 | 9.8 | 0.07 | Feb 5, 2020 | Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and… | ||
| CVE-2015-5627 | Cri | 0.64 | 9.8 | 0.04 | Feb 5, 2020 | Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and… | ||
| CVE-2015-5626 | Cri | 0.64 | 9.8 | 0.04 | Feb 5, 2020 | Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and… | ||
| CVE-2010-4815 | Cri | 0.64 | 9.8 | 0.02 | Feb 5, 2020 | Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution. | ||
| CVE-2010-4662 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | PmWiki before 2.2.21 has XSS. | ||
| CVE-2020-3149 | Med | 0.31 | 4.8 | 0.01 | Feb 5, 2020 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insufficient input… | ||
| CVE-2020-3123 | Hig | 0.49 | 7.5 | 0.03 | Feb 5, 2020 | A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds… | ||
| CVE-2020-3120 | Med | 0.42 | 6.5 | 0.02 | Feb 5, 2020 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition.… | ||
| CVE-2020-3119 | Hig | 0.58 | 8.8 | 0.05 | Feb 5, 2020 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Protocol parser does… | ||
| CVE-2020-3118 | Hig | 0.70 | 8.8 | 0.12 | KEV | Feb 5, 2020 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from… | |
| CVE-2020-3111 | Hig | 0.57 | 8.8 | 0.03 | Feb 5, 2020 | A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missing checks when… | ||
| CVE-2020-3110 | Hig | 0.58 | 8.8 | 0.06 | Feb 5, 2020 | A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is due to missing… | ||
| CVE-2019-15253 | Med | 0.34 | 4.8 | 0.03 | Feb 5, 2020 | A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected… | ||
| CVE-2015-0102 | Hig | 0.53 | 8.1 | 0.02 | Feb 5, 2020 | IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. | ||
| CVE-2013-2675 | Med | 0.42 | 6.5 | 0.02 | Feb 5, 2020 | Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information. |
- risk 0.35cvss 6.5epss 0.03
coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
- risk 0.63cvss 8.8epss 0.40
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an…
- risk 0.43cvss 6.1epss 0.06
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
- risk 0.42cvss 6.5epss 0.01
Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier…
- risk 0.58cvss 8.8epss 0.10
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of…
- risk 0.51cvss 7.8epss 0.00
The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable…
- risk 0.28cvss 4.3epss 0.01
The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.
- risk 0.28cvss 4.3epss 0.01
The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.
- risk 0.35cvss 5.3epss 0.01
The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.
- risk 0.32cvss 4.9epss 0.01
Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability.
- risk 0.42cvss 6.5epss 0.01
Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities.
- risk 0.51cvss 7.8epss 0.00
The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability.
- risk 0.28cvss 4.3epss 0.01
Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control…
- risk 0.49cvss 7.5epss 0.02
The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
- risk 0.38cvss 5.9epss 0.00
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.
- risk 0.46cvss 7.1epss 0.01
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.
- risk 0.40cvss 6.1epss 0.00
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.
- risk 0.57cvss 8.8epss 0.02
OpenVAS Manager v2.0.3 allows plugin remote code execution.
- risk 0.64cvss 9.8epss 0.04
SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet, an attacker could exploit this vulnerability to cause the application to crash.
- risk 0.79cvss 9.8epss 0.87
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
- risk 0.59cvss 9.1epss 0.02
Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.
- risk 0.40cvss 6.1epss 0.01
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
- risk 0.58cvss 8.8epss 0.12
Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API.
- risk 0.31cvss 4.3epss 0.06
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.
- risk 0.68cvss 9.8epss 0.10
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access.
- risk 0.52cvss 7.5epss 0.09
Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information.
- risk 0.40cvss 6.1epss 0.01
PHPShop through 0.8.1 has XSS.
- risk 0.33cvss 6.1epss 0.01
Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.
- risk 0.57cvss 8.8epss 0.01
Batavi before 1.0 has CSRF.
- risk 0.64cvss 9.8epss 0.02
Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint.
- risk 0.40cvss 6.1epss 0.02
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
- risk 0.36cvss 5.5epss 0.00
Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet.
- risk 0.49cvss 7.5epss 0.03
A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.
- risk 0.64cvss 9.8epss 0.07
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and…
- risk 0.64cvss 9.8epss 0.04
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and…
- risk 0.64cvss 9.8epss 0.04
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and…
- risk 0.64cvss 9.8epss 0.02
Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution.
- risk 0.40cvss 6.1epss 0.01
PmWiki before 2.2.21 has XSS.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insufficient input…
- risk 0.49cvss 7.5epss 0.03
A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds…
- risk 0.42cvss 6.5epss 0.02
A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition.…
- risk 0.58cvss 8.8epss 0.05
A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Protocol parser does…
- risk 0.70cvss 8.8epss 0.12
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from…
- risk 0.57cvss 8.8epss 0.03
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missing checks when…
- risk 0.58cvss 8.8epss 0.06
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is due to missing…
- risk 0.34cvss 4.8epss 0.03
A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected…
- risk 0.53cvss 8.1epss 0.02
IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- risk 0.42cvss 6.5epss 0.02
Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.