CVEs published in January 2020
1,599 vulnerabilities, 235 critical, 8 exploited.
- openpneOpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection...9.1 Critical
- easytimestudio easy file managerEasytime Studio Easy File Manager 1.1 has a HTTP request security bypass9.9 Critical
- lorextechnology lnc104 firmware, lnc116 firmware +1 moreLorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability9.8 Critical
- vt cryptacular, oracle communications services gatekeeper, webcenter sites +1 more +3 moreDenial of Service in Cryptacular7.5 High
- soapbox project soapboxSoapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed...7.8 High
- suse yast2-security, opensuse factory +1 moreyast: Fallback to DES without configuration in /etc/login.def2.9 Low
- opensuse factory, leap 15.1, privoxy +2 moreLocal privilege escalation from user privoxy to root7.7 High
- gnu gnump3d, opensuse leap, leap 15.1 +2 moreLocal privilege escalation from user gnump3d to root7.7 High
- libp2p libp2p-deflateUse of Uninitialized Resource in libp2p-deflate9.8 Critical
- rust-lang future-utilsImproper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption5.5 Medium
- actix actix-httpUse-after-free in actix-http7.5 High
- lucet-runtime-internals project lucet-runtime-internalsOut of bounds access in lucet-runtime-internals9.1 Critical
- opensuse factory, leap 15.1, munin +2 moreLocal privilege escalation from munin to root in the packaging of munin7.7 High
- opensuse factory, leap, leap 15.1 +3 more +5 moreLocal privilege escalation from user news to root in the packaging of inn7.7 High
- suse linux enterprise server"easy" permission profile allows everyone execute dumpcap and read all network traffic4.0 Medium
- ctfdIncorrect username validation in the registration processes of CTFd through 2.2.2 allows a remote...9.8 Critical
- devfarm wp gpx mapsWordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via...9.8 Critical
- ge d200 firmware, d20me firmware +1 moreGeneral Electric D20ME devices are not properly configured and reveal plaintext passwords.7.5 High
- citrix xenserverCitrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5...7.8 High
- artifex mupdf, sumatrapdfreader sumatrapdf +1 moreSumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number...7.8 High
- dart powertcp webserver for activexNULL Pointer Dereference in PowerTCP WebServer for ActiveX 1.9.2 and earlier allows remote...7.5 High
- philips hue bridge v2 firmwarePhilips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based...7.9 High
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there is Directory Traversal on TCP port 8000 via the Engine...7.5 High
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent...5.5 Medium
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other...8.8 High
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there is Remote Code Execution via weak permissions on the Engine...9.9 Critical
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there is Remote Code Execution via the Agent Service. An...10.0 Critical
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP...7.5 High
- plonePlone Open Redirect Vulnerability6.1 Medium
- plonePlone cross site scripting (XSS)5.4 Medium
- plonePlone Privilege Escallation8.8 High
- plonePlone SQL Injection Vulnerability8.8 High
- plonePlone allows weak passwords7.5 High
- plonePlone Unauthenticated Write Vulnerability9.8 Critical
- libressl, opensuse +1 moreMemory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause...7.5 High
- libressl, opensuse +1 moreOff-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to...9.8 Critical
- sap netweaverA Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in...7.5 High
- owncloud, owncloud server +1 moreCross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before...6.5 Medium
- sap netweaverA Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics()...9.8 Critical
- red hat jboss brms, jboss enterprise application platform, jboss enterprise web server +3 more +5 moreEJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat...7.5 High
- freecivFreeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.7.5 High
- fortinet fortimailAn improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10...4.9 Medium
- hashicorp vaultImproper Resource Shutdown or Release in HashiCorp Vault7.5 High
- fortinet fortimailAn improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10...7.2 High
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....6.5 Medium
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....5.3 Medium
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....7.2 High
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....9.8 Critical
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....4.8 Medium
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....8.8 High
- Show moreLoading…