CVEs published in January 2020
1,599 vulnerabilities, 235 critical, 8 exploited.
- arialsoftware campaign enterpriseIn Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without...7.5 High
- arialsoftware campaign enterpriseArial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.7.5 High
- arialsoftware campaign enterpriseArial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page,...7.5 High
- bftpd project bftpdAn issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is...9.1 Critical
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The...5.3 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be...5.1 Medium
- otrs, otrs ag ((otrs)) community edition, debian linux +2 morePossible to send drafted messages as wrong agent3.5 Low
- otrs, otrs ag ((otrs)) community edition, debian linux +2 moreImproper handling of uploaded inline images2.0 Low
- otrs, otrs ag ((otrs)) community edition, debian linux +2 more +4 moreSpoofing of From field in several screens3.5 Low
- status2kStatus2k does not remove the install directory allowing credential reset.9.8 Critical
- status2kStatus2k allows Remote Command Execution in admin/options/editpl.php.8.8 High
- pretty-link plugin, caseproof prettylinks +1 morePretty-Link WordPress plugin 1.5.2 has XSS6.1 Medium
- ep imageconvert project imageconvertThe Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability9.8 Critical
- eng spagobiSpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script8.8 High
- ultimate-weather project ultimate-weatherThe ultimate-weather plugin 1.0 for WordPress has XSS6.1 Medium
- flog project flogflog plugin 0.1 for WordPress has XSS6.1 Medium
- xorux lpar2rrdLPAR2RRD ? 4.53 and ? 3.5 has arbitrary command injection on the application server.9.8 Critical
- sphider, sphider-plus, sphiderpro sphider pro +2 moresphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow...9.8 Critical
- dejavuprotech crescendo - sales crmD?j? Vu Crescendo Sales CRM has remote SQL Injection9.8 Critical
- dompdf project dompdfDOMPDF Information Disclosure6.5 Medium
- dompdf project dompdfDOMPDF denial of service vulnerability6.5 Medium
- dompdf project dompdfDOMPDF Remote Code Execution8.8 High
- google chrome, debian linux, fedoraproject fedora +4 more +6 moreUse after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to...8.8 High
- psi electronic logbookA cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote...6.1 Medium
- psi electronic logbookA cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote...6.1 Medium
- typoraA mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9...8.3 High
- rasilient pixelstor 5000 firmwarelanguageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows...9.8 Critical
- rasilient pixelstor 5000 firmwareA cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K...5.4 Medium
- rasilient pixelstor 5000 firmwarecontentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows...7.4 High
- samsung kiesSamsung Kies before 2.5.0.12094_27_11 has registry modification.7.5 High
- samsung kiesSamsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.7.5 High
- samsung kiesSamsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.7.5 High
- samsung kiesSamsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.9.8 Critical
- samsung kiesSamsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which...7.5 High
- peel shoppingAdvisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.6.5 Medium
- soplanningSOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.8.8 High
- employee records system project records systemuploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code...7.2 High
- getawesomesupport awesome supportThe awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.4.8 Medium
- keepassKeePass 2.4.1 allows CSV injection in the title field of a CSV export.7.8 High
- gatewaygeomatics mapserverGateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability...8.1 High
- fooplugins foogalleryThe FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.4.8 Medium
- tinywebgalleryPHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin...7.2 High
- fedoraproject 389 directory server, hp hp-ux directory server, redhat directory server +2 more389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server...3.3 Low
- smiley;smileys smiley, smileys +1 moreCross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1...4.8 Medium
- cipherdyne fwknopfwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash)...8.8 High
- condor, wisc htcondor +1 moreThe (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3)...8.8 High
- invisioncommunity invision power boardInvision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote...9.8 Critical
- codeigniterEllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform...6.1 Medium
- digi anywhereusb\/14 firmwareDigi AnywhereUSB 14 allows XSS via a link for the Digi Page.6.1 Medium
- f5 nginx, apple xcode, canonical ubuntu linux +2 more +4 moreNGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as...5.3 Medium
- Show moreLoading…