| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-9539 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated… | ||
| CVE-2019-9538 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos… | ||
| CVE-2019-9537 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message… | ||
| CVE-2019-19959 | Hig | 0.49 | 7.5 | 0.03 | Jan 3, 2020 | ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind. | ||
| CVE-2014-8516 | Cri | 0.73 | 9.8 | 0.82 | Jan 3, 2020 | Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors. | ||
| CVE-2020-5395 | Hig | 0.57 | 8.8 | 0.02 | Jan 3, 2020 | FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. | ||
| CVE-2014-8337 | Cri | 0.64 | 9.8 | 0.05 | Jan 3, 2020 | Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the… | ||
| CVE-2014-5516 | Med | 0.42 | 6.5 | 0.01 | Jan 3, 2020 | Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request. | ||
| CVE-2014-5140 | Hig | 0.53 | 8.8 | 0.03 | Jan 3, 2020 | The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book. | ||
| CVE-2014-4196 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attackers to inject arbitrary web script or HTML via the colorstyle parameter. | ||
| CVE-2014-10398 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5, 2.4, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) DICTIONARY, (2) FILTERIDENT,… | ||
| CVE-2012-5878 | Cri | 0.67 | 9.8 | 0.09 | Jan 3, 2020 | Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to… | ||
| CVE-2012-5693 | Hig | 0.57 | 8.8 | 0.02 | Jan 3, 2020 | Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the filename parameter to (3) CSAttack.pl or… | ||
| CVE-2019-11994 | Cri | 0.64 | 9.8 | 0.07 | Jan 3, 2020 | A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell… | ||
| CVE-2019-11993 | Hig | 0.49 | 7.5 | 0.02 | Jan 3, 2020 | A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell… | ||
| CVE-2019-5064 | Hig | 0.58 | 8.8 | 0.11 | Jan 3, 2020 | An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker… | ||
| CVE-2019-5063 | Hig | 0.59 | 8.8 | 0.21 | Jan 3, 2020 | An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a… | ||
| CVE-2019-19310 | Med | 0.32 | 4.9 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure. | ||
| CVE-2019-19309 | Med | 0.21 | 4.3 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control. | ||
| CVE-2019-19263 | Med | 0.28 | 4.3 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. | ||
| CVE-2019-19262 | Med | 0.28 | 4.3 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions. | ||
| CVE-2019-19261 | Hig | 0.57 | 8.8 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF. | ||
| CVE-2019-19260 | Med | 0.28 | 5.4 | 0.01 | Jan 3, 2020 | GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2). | ||
| CVE-2019-19259 | Med | 0.21 | 4.3 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR). | ||
| CVE-2019-19258 | Med | 0.28 | 5.3 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control. | ||
| CVE-2019-19257 | Med | 0.28 | 5.3 | 0.01 | Jan 3, 2020 | GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2). | ||
| CVE-2019-19256 | Med | 0.28 | 5.3 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control. | ||
| CVE-2019-19255 | Med | 0.21 | 4.3 | 0.01 | Jan 3, 2020 | GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control. | ||
| CVE-2012-4451 | Med | 0.33 | 6.1 | 0.01 | Jan 3, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6)… | ||
| CVE-2019-19311 | Med | 0.28 | 5.4 | 0.01 | Jan 3, 2020 | GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields. | ||
| CVE-2019-19254 | Med | 0.28 | 5.3 | 0.01 | Jan 3, 2020 | GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control. | ||
| CVE-2019-19088 | Cri | 0.64 | 9.8 | 0.02 | Jan 3, 2020 | Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal. | ||
| CVE-2019-19087 | Med | 0.21 | 4.3 | 0.01 | Jan 3, 2020 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2). | ||
| CVE-2019-19086 | Med | 0.21 | 4.3 | 0.01 | Jan 3, 2020 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2). | ||
| CVE-2020-1871 | Hig | 0.53 | 8.2 | 0.01 | Jan 3, 2020 | USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 have an improper credentials management vulnerability. The software does not properly manage certain credentials. Successful exploit could… | ||
| CVE-2020-1785 | Med | 0.36 | 5.5 | 0.00 | Jan 3, 2020 | Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. The system does not properly check the status of certain module during certain operations, an attacker should trick the user into installing a malicious application, successful exploit… | ||
| CVE-2019-5304 | Hig | 0.49 | 7.5 | 0.01 | Jan 3, 2020 | Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to… | ||
| CVE-2019-19441 | Med | 0.42 | 6.5 | 0.00 | Jan 3, 2020 | HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An attacker could send specific command in the local area network (LAN) to exploit this vulnerability. Successful exploitation may cause information leak. | ||
| CVE-2019-20330 | Cri | 0.57 | 9.8 | 0.09 | Jan 3, 2020 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. | ||
| CVE-2020-5313 | Hig | 0.39 | 7.1 | 0.03 | Jan 3, 2020 | libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. | ||
| CVE-2020-5312 | Cri | 0.57 | 9.8 | 0.04 | Jan 3, 2020 | libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. | ||
| CVE-2020-5311 | Cri | 0.57 | 9.8 | 0.04 | Jan 3, 2020 | libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. | ||
| CVE-2020-5310 | Hig | 0.50 | 8.8 | 0.02 | Jan 3, 2020 | libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. | ||
| CVE-2019-20329 | Hig | 0.53 | 8.1 | 0.01 | Jan 3, 2020 | OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000. | ||
| CVE-2016-1000027 | Cri | 0.59 | 9.8 | 0.33 | Jan 2, 2020 | Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.… | ||
| CVE-2014-8182 | Hig | 0.49 | 7.5 | 0.03 | Jan 2, 2020 | An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses. | ||
| CVE-2014-6275 | Med | 0.38 | 5.9 | 0.01 | Jan 2, 2020 | FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge. | ||
| CVE-2013-1642 | Med | 0.40 | 6.1 | 0.02 | Jan 2, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) dir, (2) item, (3) order, (4) searchitem, (5) selitems[], or (6) srt parameter to index.php or (7) the QUERY_STRING to… | ||
| CVE-2013-1420 | Med | 0.40 | 6.1 | 0.01 | Jan 2, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to… | ||
| CVE-2013-0737 | Med | 0.40 | 6.1 | 0.01 | Jan 2, 2020 | Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the fieldnames parameter. |
- risk 0.40cvss 6.1epss 0.01
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated…
- risk 0.40cvss 6.1epss 0.01
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos…
- risk 0.40cvss 6.1epss 0.01
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message…
- risk 0.49cvss 7.5epss 0.03
ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
- risk 0.73cvss 9.8epss 0.82
Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
- risk 0.57cvss 8.8epss 0.02
FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
- risk 0.64cvss 9.8epss 0.05
Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the…
- risk 0.42cvss 6.5epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request.
- risk 0.53cvss 8.8epss 0.03
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attackers to inject arbitrary web script or HTML via the colorstyle parameter.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5, 2.4, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) DICTIONARY, (2) FILTERIDENT,…
- risk 0.67cvss 9.8epss 0.09
Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to…
- risk 0.57cvss 8.8epss 0.02
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the filename parameter to (3) CSAttack.pl or…
- risk 0.64cvss 9.8epss 0.07
A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell…
- risk 0.49cvss 7.5epss 0.02
A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell…
- risk 0.58cvss 8.8epss 0.11
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker…
- risk 0.59cvss 8.8epss 0.21
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a…
- risk 0.32cvss 4.9epss 0.01
GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.
- risk 0.21cvss 4.3epss 0.01
GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.
- risk 0.28cvss 4.3epss 0.01
GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.
- risk 0.28cvss 4.3epss 0.01
GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.
- risk 0.57cvss 8.8epss 0.01
GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.
- risk 0.28cvss 5.4epss 0.01
GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).
- risk 0.21cvss 4.3epss 0.01
GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).
- risk 0.28cvss 5.3epss 0.01
GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control.
- risk 0.28cvss 5.3epss 0.01
GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).
- risk 0.28cvss 5.3epss 0.01
GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.
- risk 0.21cvss 4.3epss 0.01
GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control.
- risk 0.33cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6)…
- risk 0.28cvss 5.4epss 0.01
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.
- risk 0.28cvss 5.3epss 0.01
GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.
- risk 0.64cvss 9.8epss 0.02
Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.
- risk 0.21cvss 4.3epss 0.01
Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).
- risk 0.21cvss 4.3epss 0.01
Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).
- risk 0.53cvss 8.2epss 0.01
USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 have an improper credentials management vulnerability. The software does not properly manage certain credentials. Successful exploit could…
- risk 0.36cvss 5.5epss 0.00
Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. The system does not properly check the status of certain module during certain operations, an attacker should trick the user into installing a malicious application, successful exploit…
- risk 0.49cvss 7.5epss 0.01
Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to…
- risk 0.42cvss 6.5epss 0.00
HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An attacker could send specific command in the local area network (LAN) to exploit this vulnerability. Successful exploitation may cause information leak.
- risk 0.57cvss 9.8epss 0.09
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
- risk 0.39cvss 7.1epss 0.03
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
- risk 0.57cvss 9.8epss 0.04
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
- risk 0.57cvss 9.8epss 0.04
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
- risk 0.50cvss 8.8epss 0.02
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
- risk 0.53cvss 8.1epss 0.01
OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.
- risk 0.59cvss 9.8epss 0.33
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.…
- risk 0.49cvss 7.5epss 0.03
An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.
- risk 0.38cvss 5.9epss 0.01
FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge.
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) dir, (2) item, (3) order, (4) searchitem, (5) selitems[], or (6) srt parameter to index.php or (7) the QUERY_STRING to…
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the fieldnames parameter.