CVEs published in February 2020
1,402 vulnerabilities, 227 critical, 16 exploited.
- suse linux enterprise server, linux enterprise server 12, linux enterprise server 15 +1 more +3 moremysql-systemd-helper allows setting 640 permissions of arbitrary files5.1 Medium
firefoxUbuntufirefox regressionsNo score- golfbuddyglobal course managerIn GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request.6.5 Medium
- google chrome, debian linux, fedoraproject fedora +4 more +6 moreType confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to...8.8 High
- google chromeOut of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote...8.8 High
- druva insyncImproper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client...7.8 High
- ispconfigISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is...9.8 Critical
- redhat enterprise virtualization hypervisor (aka rhev-h), enterprise virtualization, enterprise virtualization hypervisor +2 moreVDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2...7.5 High
- nacl, google native client +1 moreNaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.10.0 Critical
- gurux device language message specification directorGurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an...8.1 High
- gurux device language message specification directorAn issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS...8.1 High
- mitel micontact center businessThe Software Development Kit of the MiContact Center Business with Site Based Security 8.0...6.5 Medium
- druva insync clientImproper neutralization of special elements used in an OS command in Druva inSync Windows Client...7.8 High
- supsystic pricing table by supsysticAn issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It...8.8 High
- supsystic pricing table by supsysticAn issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It...7.2 High
- linux kernel, fedoraproject fedora, netapp active iq unified manager +6 more +8 moreAn issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture...5.5 Medium
- blackboard learnStored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users...5.4 Medium
- wpjobboardThe WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as...6.1 Medium
- litecartLiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.5.3 Medium
- litecartLiteCart through 2.2.1 allows CSV injection via a customer's profile.8.0 High
- solarwinds netpath, orion platform, network performance monitor +2 moreSolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by...4.8 Medium
- enviragallery envira galleryA stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress....5.4 Medium
- opensmtpd, canonical ubuntu linux, debian linux +1 more +3 moreOpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in...9.8 Critical
- 10web photo galleryMultiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46...4.8 Medium
- opensmtpd, canonical ubuntu linux, fedoraproject fedora +2 moreOpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux...4.7 Medium
- moxa awk-3131a firmware, moxa +1 moreAn exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of...6.2 Medium
- moxa awk-3131a firmware, moxa +1 moreAn exploitable format string vulnerability exists in the iw_console conio_writestr functionality...8.8 High
- moxa, moxa awk-3131a firmware +1 moreAn exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa...7.5 High
- moxa awk-3131a firmware, moxa +1 moreAn exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa...8.0 High
- debian linux, linux kernel, canonical ubuntu linux +9 more +11 moreAn issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c...7.1 High
- moxa awk-3131a firmware, moxa +1 moreAn exploitable remote code execution vulnerability exists in the iw_webs configuration parsing...9.9 Critical
- moxa awk-3131a firmware, moxa +1 moreAn exploitable improper access control vulnerability exists in the iw_webs account settings...9.9 Critical
- moxa awk-3131a firmware, moxa +1 moreThe usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the...7.5 High
- moxa awk-3131a firmware, moxa +1 moreAn exploitable command injection vulnerability exists in encrypted diagnostic script...9.9 Critical
- moxa awk-3131a firmware, moxa +1 moreAn exploitable privilege escalation vulnerability exists in the iw_console functionality of the...8.8 High
- moxa awk-3131a firmware, moxa +1 moreAn exploitable command injection vulnerability exists in the hostname functionality of the Moxa...7.2 High
- moxa awk-3131a firmware, moxa +1 moreAn exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa...8.8 High
- moxa awk-3131a firmware, moxa +1 moreAn exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK...8.8 High
- ibm qradar advisorIBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive...5.3 Medium
- ibm qradar advisorIBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms...5.9 Medium
- adobe magento, cardgate payments +1 moreOrigin Validation Error in Magento 28.1 High
- cardgate paymentsCardGate Payments plugin for WooCommerce does not validate request origin8.1 High
- iblsoft online weatherIBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the...3.1 Low
- iblsoft online weatherIBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of...9.0 Critical
- iblsoft online weatherIBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.5.8 Medium
- zintA NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are...7.5 High
- widgets project widgetsAn issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title...5.4 Medium
- totaljs total.js cmscontrollers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a...7.5 High
- apache tomcat, geode, blackberry good control +18 more +20 moreImproper Privilege Management in Tomcat9.8 Critical
- apache tomcat, canonical ubuntu linux, debian linux +17 more +19 morePotential HTTP request smuggling in Apache Tomcat4.8 Medium
- Show moreLoading…