CVEs published in January 2020
1,599 vulnerabilities, 235 critical, 8 exploited.
- schedmd slurm, opensuse leap +1 moreSchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.5.5 Medium
- schedmd slurm, debian linux, opensuse leap +2 moreSchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.7.5 High
- pysaml2 project pysaml2, canonical ubuntu linux, debian linux +2 moreImproper Verification of Cryptographic Signature in PySAML27.5 High
- cththemes citybook, easybook, townhub +2 moreThe CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for...6.1 Medium
- mitel sip-dect firmwareAn encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an...5.9 Medium
- cththemes citybook, easybook, townhub +2 moreThe CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for...6.1 Medium
- cerberusftp ftp serverReflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17...6.1 Medium
- cththemes citybook, easybook, townhub +2 moreThe CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for...6.1 Medium
- cththemes citybook, easybook, townhub +2 moreThe CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for...7.5 High
graphicsmagickMageiaUpdated graphicsmagick packages fix security vulnerabilitiesNo scoreunboundMageiaUpdated unbound packages fix potential security vulnerabilitiesNo score- ultimatemember ultimate memberMultiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the...5.3 Medium
- avast premium securityIn Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local...7.8 High
- avast secure browser, video downloader project downloader +1 moreXSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG...6.1 Medium
- symantec endpoint detection and response (sedr), endpoint detection and response, fedoraproject fedora +2 moreSymantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross...6.1 Medium
- free freebox osFreebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation6.5 Medium
- mozilla firefoxMozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets6.1 Medium
- livezillaLiveZilla 5.0.1.4 has a Remote Code Execution vulnerability9.8 Critical
- opensuse libzypp, suse caas platform 3.0, linux enterprise server 12 +1 more +3 morelibzypp stores cookies world readable4.0 Medium
- granding grand ma300 firmwareGrand MA 300 allows a brute-force attack on the PIN.9.8 Critical
- granding grand ma300 firmwareGrand MA 300 allows retrieval of the access PIN from sniffed data.7.5 High
- zohocorp manageengine eventlog analyzerManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure...7.5 High
- zohocorp manageengine eventlog analyzerZoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information...7.5 High
- vasyltech advanced access managerWordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability7.2 High
- symonics libmysofa, fedoraproject fedora +1 morelibmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the...8.8 High
- uclouvain openjpeg, debian linux, fedoraproject fedora +9 more +11 moreOpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in...7.5 High
- axper vision ii firmwareAxper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the...6.1 Medium
- debian linux, gnome gthumb, linuxmint pix +2 moregthumb - security update7.8 High
pcsc-liteMageiaUpdated pcsc-lite packages fix security vulnerabilityNo score- opentrade project opentradeOpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator...7.6 High
- tophub toplistTopList before 2019-09-03 allows XSS via a title.6.1 Medium
- ganglia ganglia-webganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.6.1 Medium
- ganglia ganglia-webganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.6.1 Medium
- mrubyIn mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash...9.8 Critical
- mrubyIn mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.9.8 Critical
- mrubyIn mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c.9.8 Critical
- hot-formula-parser project hot-formula-parserCommand Injection in hot-formula-parser9.8 Critical
- zohocorp manageengine applications managerAn issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated...8.8 High
- bftpd project bftpdAn issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file...9.8 Critical
- citrix receiver, xenapp online +1 moreCitrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2...7.8 High
- arialsoftware campaign enterpriseA Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign...4.3 Medium
- sparklabs viscosityA Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name...9.8 Critical
- dell emc powermax, emc unisphere for powermax, unisphere for powermax +2 moreDell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax...9.0 Critical
- online tv database project tv databaseAn SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011.9.8 Critical
- ricoh m 2700 firmware, m 2701 firmware, m c250fw firmware +49 more +51 moreRicoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).7.5 High
- ricoh m 2700 firmware, m 2701 firmware, mp 2014 firmware +58 more +60 moreOn Ricoh SP C250DN 1.06 devices, a debug port can be used.6.8 Medium
- ricoh m 2700 firmware, m 2701 firmware, mp 2014 firmware +45 more +47 moreRicoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).7.5 High
- ricoh m 2700 firmware, m 2701 firmware, m c250fw firmware +49 more +51 moreRicoh SP C250DN 1.06 devices allow CSRF.8.8 High
- totalav 2020TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an...7.8 High
- chamilo lmsChamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script,...7.5 High
- Show moreLoading…