Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,571 results · page 176 of 392
Jul 14, 2020This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attCVE-2020-1454 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'.
- Product
- Microsoft SharePoint Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected ShaCVE-2020-1451 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1456.
- Product
- Microsoft SharePoint Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected ShaCVE-2020-1450 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1451, CVE-2020-1456.
- Product
- Microsoft SharePoint Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, akCVE-2020-1443 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'.
- Product
- Microsoft SharePoint Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability'.CVE-2020-1442 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.1
A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability'.
- Product
- Microsoft Office Online Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site SCVE-2020-1326 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.
- Product
- Azure DevOps Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.CVE-2020-6292 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.
- Product
- SAP Disclosure Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 14, 2020SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leadinCVE-2020-6291 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration
- Product
- SAP Disclosure Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 14, 2020SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in CroCVE-2020-6281 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting.
- Product
- SAP Business Objects Business Intelligence Platform (BI Launchpad)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 14, 2020SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site ScriptCVE-2020-6276 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.
- Product
- SAP Business Objects Business Intelligence Platform (bipodata)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 13, 2020IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system.CVE-2019-4591 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 167451.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 9, 2020IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies.CVE-2020-4173 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 174682.
- Product
- InfoSphere Guardium Activity Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 9, 2020The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures.CVE-2020-15093 · Other software · awslabs · reported by GitHubHigh 8.6
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.
- Product
- tough
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2020The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection.CVE-2020-3973 · Other software · Arista · reported by security@vmware.comHigh 8.8
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.
- Product
- Velocloud Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2020Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.CVE-2020-12821 · Other software · Protocol · reported by MITRECritical 9.8
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
- Product
- Gossipsub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoin.stackexchange.comgateway.ipfs.io
Jul 7, 2020Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts.CVE-2020-15367 · Other software · Venki · reported by MITRECritical 9.8
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.
- Product
- Supravizio BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvenki.com.br
Jul 5, 2020SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.CVE-2020-15543 · Other software · Solarwinds · reported by MITRECritical 9.8
SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.
- Product
- Serv-u FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comdocumentation.solarwinds.com
Jul 2, 2020Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripCVE-2020-2219 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.
- Product
- Jenkins Link Column Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, CVE-2020-2217 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Compatibility Action Storage Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resultingCVE-2020-2211 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
- Product
- Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scrCVE-2020-2207 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins VncViewer Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site CVE-2020-2206 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins VncRecorder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site scriptiCVE-2020-2205 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.8
Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators.
- Product
- Jenkins VncRecorder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site sCVE-2020-2201 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability.
- Product
- Jenkins Sonargraph Integration Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF).CVE-2020-12119 · Other software · Ledger · reported by MITREHigh 8.1
Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result, users are exposed to basic double spending attacks, amplified double spending attacks, and DoS attacks without user consent.
- Product
- Ledger Live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddonjon.ledger.comdonjon.ledger.com
Jul 1, 2020In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files.CVE-2020-5906 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.1
In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.
- Product
- Big-ip Access Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comkb.cert.org
Jul 1, 2020In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.CVE-2020-5905 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 4.3
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.
- Product
- Big-ip Access Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comkb.cert.org
Jul 1, 2020Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does noCVE-2020-12604 · Other software · Envoyproxy · reported by MITREHigh 7.5
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.
- Product
- Envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2020IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies.CVE-2019-4704 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 172014.
- Product
- Security Identity Manager Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 30, 2020NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts operations within the bCVE-2020-5968 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed by using an index or pointer, such as memory or files, which may lead to code execution, denial of service, escalation of privileges, or information disclosure. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).
- Product
- NVIDIA vGPU Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jun 29, 2020AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3CVE-2020-15368 · Other software · Asrock · reported by MITREMedium 5.5
AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.
- Product
- RGB Driver Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodetector.orggithub.com
Jun 29, 2020Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitCVE-2020-12048 · Other software · Baxter · reported by ics-cert@hq.dhs.govHigh 7.5
Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool.
- Product
- Phoenix X36 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Jun 29, 2020Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from CVE-2020-12024 · Other software · Baxter · reported by ics-cert@hq.dhs.govMedium 6.1
Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to the system the ability to load an unauthorized payload or unauthorized access to the hard drive by booting a live USB OS. This could impact confidentiality and integrity of the system and risk exposure of sensitive information including PHI.
- Product
- Em2400 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Jun 29, 2020Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining aCVE-2020-12020 · Other software · Baxter · reported by ics-cert@hq.dhs.govMedium 6.1
Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user.
- Product
- Em2400 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Jun 25, 2020In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian cCVE-2020-15302 · Other software · Argent · reported by MITREHigh 7.5
In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian case, which allows attackers to cause a denial of service (locking) or a takeover.
- Product
- Recoverymanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.openzeppelin.comblog.openzeppelin.com
Jun 24, 2020In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for CVE-2020-7667 · Other software · SAS · reported by report@snyk.ioHigh 7.5
In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released.
- Product
- GO RPM Utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2020In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied identifiers, which couCVE-2020-12033 · Other software · Rockwellautomation · reported by ics-cert@hq.dhs.govHigh 8.8
In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied identifiers, which could allow an unauthenticated, adjacent attacker to execute remote COM objects with elevated privileges.
- Product
- Factorytalk Services Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Jun 23, 2020In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or nonCVE-2020-7668 · Other software · Compression And Archive Extensions TZ Project · reported by report@snyk.ioHigh 7.5
In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
- Product
- Compression And Archive Extensions TZ Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2020In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or noCVE-2020-7664 · Other software · Compression And Archive Extensions Project · reported by report@snyk.ioHigh 7.5
In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
- Product
- Compression And Archive Extensions ZIP Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2020The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow.CVE-2020-14983 · Other software · Chocolate-doom · reported by MITRECritical 9.8
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.
- Product
- Chocolate Doom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 22, 2020Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler.CVE-2020-14049 · Other software · Rakuten · reported by MITREHigh 7.5
Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this issue exists because of an incomplete fix for CVE-2019-12569.
- Product
- Viber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2020Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.CVE-2020-14961 · Other software · Concretecms · reported by MITREMedium 5.3
Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2020Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm.CVE-2020-14423 · Other software · Convos · reported by MITREMedium 5.3
Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECRET value, affecting password resets and invitations.
- Product
- Convos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2020The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (RFCVE-2020-14157 · Other software · Abus · reported by MITREHigh 8.1
The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (RFID tokens). This makes it easier for an attacker to disarm the wireless alarm system.
- Product
- Secvest Wireless Control Fube50001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 15, 2020user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.CVE-2020-14156 · Other software · Openbmc-project · reported by MITREHigh 8.8
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
- Product
- Openbmc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2020In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memoryCVE-2020-14152 · Other software · IJG · reported by MITREHigh 7.1
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
- Product
- Libjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordijg.orgbugs.gentoo.org
Jun 14, 2020The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive that may contain PHP coCVE-2020-14067 · Other software · Naviwebs · reported by MITRECritical 9.8
The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive that may contain PHP code, in check_upload in lib/packages/extensions/extension.class.php and lib/packages/themes/theme.class.php.
- Product
- Navigatecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict useCVE-2020-13445 · Other software · Liferay · reported by MITREHigh 8.8
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.liferay.comportal.liferay.dev
Jun 10, 2020Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information retCVE-2020-13444 · Other software · Liferay · reported by MITREMedium 6.5
Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.liferay.comportal.liferay.dev
Jun 10, 2020Kata Containers doesn't restrict containers from accessing the guest's root filesystem device.CVE-2020-2023 · Other software · Kata Containers · reported by psirt@paloaltonetworks.comLow 3.8
Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
- Product
- Kata Containers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.