Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 06:43Z
2020-02-24
2020-02-24 22:15Z
CRIT

CVE-2020-1938 — Apache Geode: This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1938in the wild

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configur CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

VNDApacheVNDFedoraprojectTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2020-02-24
2020-02-24 22:15Z
MED

CVE-2020-1935 — Apache Tomcat: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1935

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. CVSSv3.1 4.8 (MEDIUM) · EPSS 95th percentile

CWECWE 444VNDApacheTYPVulnerability
4.8
CVSS v3.1
77
Edit Score
2020-02-19
2020-02-19 20:15Z
MED

CVE-2020-3153 — Cisco Anyconnect_secure_mobility_client: A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3153in the wild

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to CVSSv3.1 6.5 (MEDIUM) · EPSS 98th percentile

CWECWE 427VNDCiscoTYPVulnerabilitySTAitw exploited
6.5
CVSS v3.1
91
Edit Score
2020-02-12
2020-02-12 00:15Z
HIGH

CVE-2020-8892 — Misp-project Misp: An issue was discovered in MISP before 2.4.121.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-8892

An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests. CVSSv3.1 8.1 (HIGH) · EPSS 74th percentile

VNDMispVNDMisp ProjectTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2020-02-10
2020-02-10 21:56Z
CRIT

CVE-2020-8840 — Fasterxml Jackson-databind: 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-8840

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 502VNDNetappVNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-01-29
2020-01-29 21:15Z
CRIT

CVE-2019-20445 — Netty Netty: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. CVSSv3.1 9.1 (CRITICAL) · EPSS 96th percentile

CWECWE 444VNDNettyVNDHttpobjectdecoderTYPVulnerability
9.1
CVSS v3.1
100
Edit Score
2020-01-29
2020-01-29 21:15Z
CRIT

CVE-2019-20444 — Netty Netty: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20444

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." CVSSv3.1 9.1 (CRITICAL) · EPSS 95th percentile

CWECWE 444VNDNettyVNDHttpobjectdecoderTYPVulnerability
9.1
CVSS v3.1
98
Edit Score
728 × 90 / responsive · programmatic ad slot
2020-01-17
2020-01-17 00:15Z
HIGH

CVE-2020-5398 — Vmware Spring_framework: In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-5398

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 79CWECWE 494VNDVmwareVNDOracleTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2020-01-14
2020-01-14 23:15Z
HIGH

CVE-2020-0638 — Microsoft Windows_10_1709: An elevation of privilege vulnerability exists in the way the Update Notification Manager handles

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-0638in the wild

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'. CVSSv3.1 7.8 (HIGH) · EPSS 86th percentile

CWECWE 59VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
90
Edit Score
2020-01-08
2020-01-08 17:15Z
CRIT

CVE-2019-20367 — Freedesktop Libbsd: nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20367

nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). CVSSv3.1 9.1 (CRITICAL) · EPSS 86th percentile

CWECWE 125VNDCanonicalVNDFreedesktopTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2020-01-08
2020-01-08 17:15Z
HIGH

CVE-2014-5287 — Progress Loadmaster: A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2014-5287

A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface (WUI). CVSSv3.1 8.8 (HIGH) · EPSS 94th percentile

CWECWE 74VNDProgressVNDBashTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2020-01-03
2020-01-03 04:15Z
CRIT

CVE-2019-20330 — Fasterxml Jackson-databind: 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20330

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 502VNDOracleVNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-01-02
2020-01-02 23:15Z
CRIT

CVE-2016-1000027 — Vmware Spring_framework: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-1000027

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 502VNDVmwareVNDPivotalTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-01-02
2020-01-02 14:16Z
HIGH

CVE-2019-20205 — Saitoha Libsixel: 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20205

libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c. CVSSv3.1 8.8 (HIGH)

CWECWE 190VNDSaitohaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2019-12-30
2019-12-30 17:15Z
HIGH

CVE-2019-20140 — Saitoha Libsixel: There is a heap-based buffer overflow in the function gif_out_code at fromgif.c.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20140

An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_out_code at fromgif.c. CVSSv3.1 8.8 (HIGH)

CWECWE 787VNDSaitohaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2019-12-30
2019-12-30 04:15Z
HIGH

CVE-2019-20094 — Saitoha Libsixel: There is a heap-based buffer overflow in the function gif_init_frame at fromgif.c.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20094

An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_init_frame at fromgif.c. CVSSv3.1 8.8 (HIGH)

CWECWE 787VNDSaitohaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2019-12-27
2019-12-27 14:15Z
CRIT

CVE-2019-19781 — Citrix Application_delivery_controller_firmware: They allow Directory Traversal.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-19781in the wild

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 22VNDCitrixTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2019-12-23
2019-12-23 17:15Z
HIGH

CVE-2019-17563 — Apache Tomcat: When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-17563

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile

CWECWE 384VNDApacheVNDFormTYPVulnerability
7.5
CVSS v3.1
91
Edit Score
2019-12-20
2019-12-20 17:15Z
CRIT

CVE-2019-17571 — Apache Log4j: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 502VNDApacheVNDIncludedTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-12-18
2019-12-18 21:15Z
CRIT

CVE-2019-15598 — Tree-kill_project Tree-kill: A Code Injection exists in treekill on Windows which allows a remote code execution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-15598

A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. CVSSv3.1 9.8 (CRITICAL) · EPSS 86th percentile

CWECWE 94CWECWE 78VNDCodeVNDTree Kill ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-12-17
2019-12-17 23:15Z
HIGH

CVE-2019-7481 — Sonicwall Sma_100_firmware: Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-7481in the wild

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 89VNDSonicwallVNDVulnerabilityTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2019-12-17
2019-12-17 18:15Z
CRIT

CVE-2019-19634 — Verot_project Verot: class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-19634

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576. CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile

CWECWE 434VNDVerot ProjectVNDJoomlaworksTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-12-16
2019-12-16 20:15Z
CRIT

CVE-2019-18269 — Omron Plc_cj_firmware: Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-18269

Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 412VNDOmronVNDPlcsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2019-12-16
2019-12-16 20:15Z
HIGH

CVE-2019-13533 — Omron Plc_cj_firmware: In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-13533

In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves. CVSSv3.1 8.1 (HIGH) · EPSS 51th percentile

CWECWE 294VNDOmronTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2019-12-13
2019-12-13 02:15Z
HIGH

CVE-2019-19778 — Saitoha Libsixel: An issue was discovered in libsixel 1.8.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-19778

An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c. CVSSv3.1 8.8 (HIGH)

CWECWE 125VNDSaitohaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score