Lista CVE - 2020 / Febbraio
Visualizzazione 1201 - 1300 di 1397 CVE per Febbraio 2020 (Pagina 13 di 14)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2020-1937 | 2020-02-24 | Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. |
| CVE-2019-17569 | 2020-02-24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were... |
| CVE-2020-1935 | 2020-02-24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers... |
| CVE-2020-1938 | 2020-02-24 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a... |
| CVE-2020-9381 | 2020-02-24 | controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954. |
| CVE-2020-9382 | 2020-02-24 | An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this... |
| CVE-2020-9385 | 2020-02-24 | A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EAN barcode generation. |
| CVE-2020-9405 | 2020-02-25 | IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page. |
| CVE-2020-9406 | 2020-02-25 | IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service. |
| CVE-2020-9407 | 2020-02-25 | IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie. |
| CVE-2020-8819 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely... |
| CVE-2020-8818 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to... |
| CVE-2019-4557 | 2020-02-25 | IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 166206. |
| CVE-2019-4672 | 2020-02-25 | IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. IBM... |
| CVE-2019-5140 | 2020-02-25 | An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be... |
| CVE-2019-5141 | 2020-02-25 | An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip parameter can cause user input to be reflected in... |
| CVE-2019-5142 | 2020-02-25 | An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary... |
| CVE-2019-5136 | 2020-02-25 | An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted menu selection string can cause an escape from the restricted... |
| CVE-2019-5138 | 2020-02-25 | An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file can cause arbitrary busybox commands to... |
| CVE-2019-5137 | 2020-02-25 | The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa AWK-3131A firmware version 1.13. |
| CVE-2019-5162 | 2020-02-25 | An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite... |
| CVE-2019-5153 | 2020-02-25 | An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause an overflow... |
| CVE-2020-9383 | 2020-02-25 | An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before... |
| CVE-2019-5165 | 2020-02-25 | An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. A specially configured device hostname can cause the device to interpret select remote... |
| CVE-2019-5148 | 2020-02-25 | An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will... |
| CVE-2019-5143 | 2020-02-25 | An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted time server entry can cause an overflow of the... |
| CVE-2019-5139 | 2020-02-25 | An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. The device operating system contains an undocumented encryption password, allowing for... |
| CVE-2020-8793 | 2020-02-25 | OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in... |
| CVE-2020-9335 | 2020-02-25 | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code... |
| CVE-2020-8794 | 2020-02-25 | OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is... |
| CVE-2020-9334 | 2020-02-25 | A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript... |
| CVE-2019-12863 | 2020-02-25 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. |
| CVE-2020-9017 | 2020-02-25 | LiteCart through 2.2.1 allows CSV injection via a customer's profile. |
| CVE-2020-9018 | 2020-02-25 | LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user. |
| CVE-2020-9019 | 2020-02-25 | The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. |
| CVE-2020-9008 | 2020-02-25 | Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor. |
| CVE-2020-9391 | 2020-02-25 | An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system... |
| CVE-2020-9393 | 2020-02-25 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS. |
| CVE-2020-9394 | 2020-02-25 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. |
| CVE-2019-3999 | 2020-02-25 | Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges. |
| CVE-2020-9379 | 2020-02-25 | The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authenticated user to access sensitive information. A successful exploit could... |
| CVE-2020-8810 | 2020-02-25 | An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for... |
| CVE-2020-8809 | 2020-02-25 | Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying... |
| CVE-2015-0565 | 2020-02-25 | NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible. |
| CVE-2015-5201 | 2020-02-25 | VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is... |
| CVE-2020-9398 | 2020-02-25 | ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection. |
| CVE-2019-4000 | 2020-02-25 | Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges. |
| CVE-2020-9337 | 2020-02-26 | In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request. |
| CVE-2019-19134 | 2020-02-26 | The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker... |
| CVE-2019-19994 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command... |
| CVE-2019-19993 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary... |
| CVE-2019-19992 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web... |
| CVE-2019-19991 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Reflected Cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML... |
| CVE-2019-19990 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Stored Cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML... |
| CVE-2019-19989 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user without checking for user... |
| CVE-2019-19988 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the filesystem via... |
| CVE-2019-19987 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker can exploit the vulnerability to... |
| CVE-2019-19986 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. An attacker without authentication is able to execute arbitrary SQL SELECT statements by injecting the HTTP (POST... |
| CVE-2020-8952 | 2020-02-26 | Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter. |
| CVE-2020-8951 | 2020-02-26 | Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration Parameter Translation) page. |
| CVE-2020-9274 | 2020-02-26 | An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they... |
| CVE-2019-4537 | 2020-02-26 | IBM WebSphere Service Registry and Repository 8.5 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 165593. |
| CVE-2019-4596 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the... |
| CVE-2019-4597 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add,... |
| CVE-2019-4598 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add,... |
| CVE-2019-4726 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user... |
| CVE-2020-3165 | 2020-02-26 | Cisco NX-OS Software Border Gateway Protocol MD5 Authentication Bypass Vulnerability |
| CVE-2020-3175 | 2020-02-26 | Cisco MDS 9000 Series Multilayer Switches Denial of Service Vulnerability |
| CVE-2020-3174 | 2020-02-26 | Cisco NX-OS Software Anycast Gateway Invalid ARP Vulnerability |
| CVE-2020-3173 | 2020-02-26 | Cisco UCS Manager Software Local Management CLI Command Injection Vulnerability |
| CVE-2020-3172 | 2020-02-26 | Cisco FXOS and NX-OS Software Cisco Discovery Protocol Arbitrary Code Execution and Denial of Service Vulnerability |
| CVE-2020-3171 | 2020-02-26 | Cisco FXOS and UCS Manager Software Local Management CLI Command Injection Vulnerability |
| CVE-2020-3170 | 2020-02-26 | Cisco NX-OS Software NX-API Denial of Service Vulnerability |
| CVE-2020-3169 | 2020-02-26 | Cisco FXOS Software CLI Command Injection Vulnerability |
| CVE-2020-3168 | 2020-02-26 | Cisco Nexus 1000V Switch for VMware vSphere Secure Login Enhancements Denial of Service Vulnerability |
| CVE-2020-3167 | 2020-02-26 | Cisco FXOS and UCS Manager Software CLI Command Injection Vulnerability |
| CVE-2020-3166 | 2020-02-26 | Cisco FXOS Software CLI Arbitrary File Read and Write Vulnerability |
| CVE-2019-17274 | 2020-02-26 | NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution... |
| CVE-2019-17275 | 2020-02-26 | OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers. |
| CVE-2019-18238 | 2020-02-26 | In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in configuration files without encryption, which may allow... |
| CVE-2015-5686 | 2020-02-27 | Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to... |
| CVE-2020-3923 | 2020-02-27 | TONNET DVR – Broken Access Control |
| CVE-2020-3924 | 2020-02-27 | TONNET DVR – Firmware Injection |
| CVE-2017-6363 | 2020-02-27 | In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not... |
| CVE-2017-6371 | 2020-02-27 | Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header. |
| CVE-2019-4669 | 2020-02-27 | IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send... |
| CVE-2019-5323 | 2020-02-27 | There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sanitized before being parsed by AirWave. If conditions are... |
| CVE-2019-5326 | 2020-02-27 | An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on the AMP platform. This is possible due to... |
| CVE-2020-6863 | 2020-02-27 | ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters and send DoS attacks on the specified... |
| CVE-2020-6864 | 2020-02-27 | ZTE E8820V3 router product is impacted by an information leak vulnerability. Attackers could use this vulnerability to to gain wireless passwords. After obtaining the wireless password, the attacker could collect... |
| CVE-2020-7041 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return... |
| CVE-2020-7042 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that... |
| CVE-2020-7043 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com... |
| CVE-2017-16900 | 2020-02-27 | Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized via brute force. |
| CVE-2015-2992 | 2020-02-27 | Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. |
| CVE-2020-5400 | 2020-02-27 | Cloud Controller logs environment variables from app manifests |
| CVE-2020-5401 | 2020-02-27 | Cloud Foundry GoRouter is vulnerable to cache poisoning |
| CVE-2020-5402 | 2020-02-27 | UAA fails to check the state parameter when authenticating with external IDPs |
| CVE-2020-7061 | 2020-02-27 | heap-buffer-overflow in phar_extract_file |
| CVE-2020-7062 | 2020-02-27 | Null Pointer Dereference in PHP Session Upload Progress |