| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2012-5626 | Hig | 0.49 | 7.5 | 0.01 | Jan 23, 2020 | EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs… | ||
| CVE-2020-7220 | Hig | 0.49 | 7.5 | 0.01 | Jan 23, 2020 | HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2. | ||
| CVE-2019-16517 | Cri | 0.64 | 9.8 | 0.01 | Jan 23, 2020 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and… | ||
| CVE-2019-16516 | Med | 0.39 | 5.3 | 0.19 | Jan 23, 2020 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username. | ||
| CVE-2019-16515 | Med | 0.42 | 6.5 | 0.02 | Jan 23, 2020 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used. | ||
| CVE-2019-16514 | Hig | 0.47 | 7.2 | 0.04 | Jan 23, 2020 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server. | ||
| CVE-2019-16513 | Hig | 0.57 | 8.8 | 0.01 | Jan 23, 2020 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests. | ||
| CVE-2019-16512 | Med | 0.31 | 4.8 | 0.01 | Jan 23, 2020 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier. | ||
| CVE-2019-15712 | Hig | 0.47 | 7.2 | 0.01 | Jan 23, 2020 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for. | ||
| CVE-2019-15707 | Med | 0.32 | 4.9 | 0.01 | Jan 23, 2020 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for. | ||
| CVE-2012-6083 | Hig | 0.53 | 7.5 | 0.12 | Jan 23, 2020 | Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet. | ||
| CVE-2019-5593 | Med | 0.36 | 5.5 | 0.00 | Jan 23, 2020 | Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or… | ||
| CVE-2019-18222 | Med | 0.24 | 4.7 | 0.00 | Jan 23, 2020 | The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks. | ||
| CVE-2019-16153 | Cri | 0.64 | 9.8 | 0.01 | Jan 23, 2020 | A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials. | ||
| CVE-2019-14888 | Hig | 0.49 | 7.5 | 0.02 | Jan 23, 2020 | A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL. | ||
| CVE-2019-3691 | Hig | 0.50 | 7.7 | 0.01 | Jan 23, 2020 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to… | ||
| CVE-2007-6758 | Hig | 0.49 | 7.5 | 0.01 | Jan 23, 2020 | Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0. | ||
| CVE-2020-7931 | Hig | 0.58 | 8.8 | 0.05 | Jan 23, 2020 | In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the… | ||
| CVE-2020-6843 | Med | 0.31 | 4.8 | 0.02 | Jan 23, 2020 | Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959. | ||
| CVE-2019-19839 | Cri | 0.64 | 9.8 | 0.03 | Jan 23, 2020 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/_cmdstat.jsp via the uploadFile attribute. | ||
| CVE-2019-19838 | Cri | 0.66 | 9.8 | 0.24 | Jan 23, 2020 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/_cmdstat.jsp via the uploadFile attribute. | ||
| CVE-2019-18899 | Med | 0.40 | 6.2 | 0.00 | Jan 23, 2020 | The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to… | ||
| CVE-2019-17202 | Hig | 0.51 | 7.8 | 0.00 | Jan 23, 2020 | FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a… | ||
| CVE-2019-17201 | Hig | 0.51 | 7.8 | 0.00 | Jan 23, 2020 | FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying… | ||
| CVE-2016-1000237 | Med | 0.33 | 6.1 | 0.01 | Jan 23, 2020 | sanitize-html before 1.4.3 has XSS. | ||
| CVE-2014-7238 | Med | 0.40 | 6.1 | 0.01 | Jan 23, 2020 | The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS | ||
| CVE-2013-6792 | Cri | 0.67 | 9.8 | 0.03 | Jan 23, 2020 | Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability | ||
| CVE-2013-6785 | Med | 0.31 | 4.3 | 0.04 | Jan 23, 2020 | Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter. | ||
| CVE-2013-6773 | Hig | 0.51 | 7.8 | 0.00 | Jan 23, 2020 | Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges | ||
| CVE-2013-6772 | Med | 0.28 | 4.3 | 0.01 | Jan 23, 2020 | Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking | ||
| CVE-2013-6358 | Hig | 0.57 | 8.8 | 0.04 | Jan 23, 2020 | PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory. | ||
| CVE-2013-4176 | Med | 0.36 | 5.5 | 0.00 | Jan 23, 2020 | mysecureshell 1.31: Local Information Disclosure Vulnerability | ||
| CVE-2013-4175 | Med | 0.36 | 5.5 | 0.00 | Jan 23, 2020 | MySecureShell 1.31 has a Local Denial of Service Vulnerability | ||
| CVE-2012-5867 | Cri | 0.64 | 9.8 | 0.02 | Jan 23, 2020 | HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability | ||
| CVE-2012-5699 | Cri | 0.67 | 9.8 | 0.05 | Jan 23, 2020 | BabyGekko before 1.2.4 allows PHP file inclusion. | ||
| CVE-2012-5698 | Hig | 0.60 | 8.8 | 0.02 | Jan 23, 2020 | BabyGekko before 1.2.4 has SQL injection. | ||
| CVE-2012-4981 | Hig | 0.57 | 8.8 | 0.03 | Jan 23, 2020 | Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability | ||
| CVE-2012-4900 | Med | 0.36 | 5.5 | 0.02 | Jan 23, 2020 | Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference | ||
| CVE-2012-4863 | Med | 0.42 | 6.5 | 0.01 | Jan 23, 2020 | IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability | ||
| CVE-2012-2087 | Cri | 0.64 | 9.8 | 0.03 | Jan 23, 2020 | ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface. | ||
| CVE-2008-7314 | Hig | 0.49 | 7.5 | 0.01 | Jan 23, 2020 | mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname. | ||
| CVE-2019-18898 | Hig | 0.50 | 7.7 | 0.00 | Jan 23, 2020 | UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions… | ||
| CVE-2020-7210 | Med | 0.28 | 4.3 | 0.01 | Jan 23, 2020 | Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts. | ||
| CVE-2019-19837 | Med | 0.35 | 5.3 | 0.02 | Jan 23, 2020 | Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests. | ||
| CVE-2019-19835 | Hig | 0.49 | 7.5 | 0.02 | Jan 23, 2020 | SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI. | ||
| CVE-2020-5217 | Med | 0.22 | 4.4 | 0.02 | Jan 23, 2020 | In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive… | ||
| CVE-2020-5216 | Med | 0.22 | 4.4 | 0.01 | Jan 23, 2020 | In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header… | ||
| CVE-2020-5223 | Med | 0.33 | 6.1 | 0.01 | Jan 23, 2020 | In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been… | ||
| CVE-2019-20399 | Med | 0.31 | 5.9 | 0.01 | Jan 23, 2020 | A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack. | ||
| CVE-2020-7915 | Med | 0.31 | 4.8 | 0.01 | Jan 22, 2020 | An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator. |
- risk 0.49cvss 7.5epss 0.01
EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs…
- risk 0.49cvss 7.5epss 0.01
HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and…
- risk 0.39cvss 5.3epss 0.19
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.
- risk 0.42cvss 6.5epss 0.02
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used.
- risk 0.47cvss 7.2epss 0.04
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier.
- risk 0.47cvss 7.2epss 0.01
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for.
- risk 0.32cvss 4.9epss 0.01
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.
- risk 0.53cvss 7.5epss 0.12
Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.
- risk 0.36cvss 5.5epss 0.00
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or…
- risk 0.24cvss 4.7epss 0.00
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
- risk 0.64cvss 9.8epss 0.01
A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials.
- risk 0.49cvss 7.5epss 0.02
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
- risk 0.50cvss 7.7epss 0.01
A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to…
- risk 0.49cvss 7.5epss 0.01
Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.
- risk 0.58cvss 8.8epss 0.05
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the…
- risk 0.31cvss 4.8epss 0.02
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
- risk 0.64cvss 9.8epss 0.03
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/_cmdstat.jsp via the uploadFile attribute.
- risk 0.66cvss 9.8epss 0.24
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/_cmdstat.jsp via the uploadFile attribute.
- risk 0.40cvss 6.2epss 0.00
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to…
- risk 0.51cvss 7.8epss 0.00
FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a…
- risk 0.51cvss 7.8epss 0.00
FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying…
- risk 0.33cvss 6.1epss 0.01
sanitize-html before 1.4.3 has XSS.
- risk 0.40cvss 6.1epss 0.01
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
- risk 0.67cvss 9.8epss 0.03
Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability
- risk 0.31cvss 4.3epss 0.04
Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter.
- risk 0.51cvss 7.8epss 0.00
Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges
- risk 0.28cvss 4.3epss 0.01
Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking
- risk 0.57cvss 8.8epss 0.04
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.
- risk 0.36cvss 5.5epss 0.00
mysecureshell 1.31: Local Information Disclosure Vulnerability
- risk 0.36cvss 5.5epss 0.00
MySecureShell 1.31 has a Local Denial of Service Vulnerability
- risk 0.64cvss 9.8epss 0.02
HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability
- risk 0.67cvss 9.8epss 0.05
BabyGekko before 1.2.4 allows PHP file inclusion.
- risk 0.60cvss 8.8epss 0.02
BabyGekko before 1.2.4 has SQL injection.
- risk 0.57cvss 8.8epss 0.03
Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability
- risk 0.36cvss 5.5epss 0.02
Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference
- risk 0.42cvss 6.5epss 0.01
IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
- risk 0.64cvss 9.8epss 0.03
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
- risk 0.49cvss 7.5epss 0.01
mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
- risk 0.50cvss 7.7epss 0.00
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions…
- risk 0.28cvss 4.3epss 0.01
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
- risk 0.35cvss 5.3epss 0.02
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
- risk 0.49cvss 7.5epss 0.02
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
- risk 0.22cvss 4.4epss 0.02
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive…
- risk 0.22cvss 4.4epss 0.01
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header…
- risk 0.33cvss 6.1epss 0.01
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been…
- risk 0.31cvss 5.9epss 0.01
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.