CVEs published in January 2020
1,599 vulnerabilities, 235 critical, 8 exploited.
- icewarp server In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. 6.1 Medium
- unitedplanet intrexx Unrestricted file upload vulnerability in an unspecified third party tool in United Planet... 9.8 Critical
- nokia 1830 photonic service switch-16 firmware, 1830 photonic service switch-32 firmware, 1830 photonic service switch-4 firmware +2 more Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830... 6.1 Medium
- eucalyptus management console Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0... 9.6 Critical
- videowhisper webcam Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples... 6.1 Medium
- arox school management software php\/mysql School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF... 6.5 Medium
- arox school management software php\/mysql School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin... 6.5 Medium
- aircrack-ng Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1... 7.8 High
- open-xchange appsuite Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX)... 7.5 High
- zeuscart Multiple SQL injection vulnerabilities in ZeusCart 4.x. 8.8 High
- web2project Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated... 8.8 High
- biscom secure file transfer Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows... 6.5 Medium
- arubanetworks airwave, aruba instant, arubaos +2 more A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the... 7.5 High
- acinq eclair Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control.... 7.5 High
- lightning network daemon Improper Access Control in Lightning Network Daemon 7.5 High
- elementsproject c-lightning c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access... 7.5 High
- arubanetworks airwave, aruba instant, arubaos +1 more +3 more Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient... 9.8 Critical
- auth0 lock auth0-lock vulnerable to XSS via unsanitized placeholder property 6.1 Medium
- infoware mapsuite Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1... 6.1 Medium
- messagepack, neuecc messagepack.immutablecollection, messagepack.reactiveproperty +1 more +3 more Untrusted data can lead to DoS attack in MessagePack for C# and Unity 4.8 Medium
- media player classic - home cinema (mpc-hc), mpc-hc +1 more Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote... 7.8 High
- media player classic - home cinema (mpc-hc), mpc-hc +1 more Stack-based buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0.7858... 7.8 High
- parallel::forkmanager, cpan parallel\ +1 more Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files. 7.5 High
- file::temp, cpan file\ +1 more _is_safe in the File::Temp module for Perl does not properly handle symlinks. 3.3 Low
- batch::batchrun, cpan batch\ +1 more The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files. 7.5 High
- abrt, fedoraproject fedora, redhat automatic bug reporting tool +3 more +5 more ABRT might allow attackers to obtain sensitive information from crash reports. 7.5 High
- ceph, redhat ceph storage +1 more A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5,... 7.5 High
- ibm websphere application server IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service,... 7.5 High
- zohocorp manageengine remote access plus An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine... 4.3 Medium
- tianocore edk2, american megatrends incorporated (ami) bios, phoenix technologies ltd. sct3 +2 more Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in... 6.8 Medium
- tianocore edk2, american megatrends incorporated (ami) bios, phoenix technologies ltd. sct3 +2 more Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update... 6.8 Medium
- evernote Evernote prior to 5.5.1 has insecure password change 7.1 High
- logmein lastpass LastPass prior to 2.5.1 has an insecure PIN implementation. 6.8 Medium
- logmein lastpass LastPass prior to 2.5.1 allows secure wipe bypass. 6.1 Medium
- evernote Evernote before 5.5.1 has insecure PIN storage 4.6 Medium
- senior rubiweb Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to... 7.5 High
- simplejobscript controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated... 9.8 Critical
- netapp oncommand system manager NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary... 7.2 High
- hashicorp nomad Improper Certificate Validation in HashiCorp Nomad 9.8 Critical
- hashicorp consul Denial of Service (DoS) in HashiCorp Consul 7.5 High
- hashicorp nomad Allocation of Resources Without Limits or Throttling in HashiCorp Nomad 7.5 High
- hashicorp consul Incorrect Authorization in HashiCorp Consul 5.3 Medium
- jetbrains intellij idea In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file... 7.5 High
- fuji xerox co.,ltd. awms mobile app, fujixerox apeosware management suite +1 more The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509... 5.9 Medium
- hp inc. intel-based business pcs that support microsoft windows 10 kernel dma protection., hp elite dragonfly firmware, elite x2 g4 firmware +31 more +33 more A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution... 6.8 Medium
- [unknown] ceph, canonical ubuntu linux, opensuse leap +1 more +3 more A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An... 6.5 Medium
- ens.domains ethereum name service, ensdomains @ensdomains/ens +1 more Ethereum Name Service - Malicious takeover of previously owned ENS names 8.7 High
- gistpress project gistpress XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via... 5.4 Medium
- checkstyle XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled)) 5.3 Medium
- tiny tinymce Cross-site scripting vulnerability in TinyMCE 6.1 Medium
- Show olderLoading…