Recent 06/20/2020


The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Type »

The moderation team is working with the threat intelligence team to categorize software that is affected by security vulnerabilities. This helps to illustrate the assignment of these categories to determine the most affected software types.

Product »

Grouping vulnerabilities by products helps to get an overview. This makes it possible to determine an homogeneous landscape or the most important hotspots in heterogeneous landscapes.

Remediation »

Vendors and researchers are eager to find countermeasures to mitigate security vulnerabilities. These can be distinguished between multiple forms and levels of remediation which influence risks differently.

Exploitability »

Researcher and attacker which are looking for security vulnerabilities try to exploit them for academic purposes or personal gain. The level and quality of exploitability can be distinguished to determine simplicity and strength of attacks.

CVSSv3 Base »

The Common Vulnerability Scoring System (CVSS) is an industry standard to define the characteristics and impacts of security vulnerabilities. The base score represents the intrinsic aspects that are constant over time and across user environments. Our unique meta score merges all available scores from different sources to aggregate to the most reliable result.

CVSSv3 Temp »

The Common Vulnerability Scoring System (CVSS) uses temp scores to reflect the characteristics of a vulnerability that may change over time but not across user environments. This includes reporting confidence, exploitability and remediation levels. We do also provide our unique meta score for temp scores, even though other sources rarely publish them.

Exploit 0-day »

The moderation team is working with the threat intelligence team to determine prices for exploits. Our unique algorithm is used to identify the 0-day prices for an exploit, before it got distributed or became public. Calculated prices are aligned to prices disclosed by vulnerability broker and compared to prices we see on exploit markets.

Exploit Today »

The 0-day prices do not consider time-relevant factors. The today price does reflect price impacts like disclosure of vulnerability details, alternative exploits, availability of countermeasures. These dynamic aspects might decrease the exploit prices over time. Under certain circumstances this happens very fast.

08:18 AM7.47.1Rack Module Cookie Remote Code Execution$0-$5k$0-$5kNot DefinedOfficial Fix0.05CVE-2020-8184
08:17 AM6.46.1Ruby on Rails deserialization$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-8164
08:16 AM7.47.1Ruby on Rails ActiveStorage S3 Adapter Remote Code Execution$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-8162
08:15 AM7.36.8casperjs mergeObjects Prototype privileges management$0-$5k$0-$5kNot DefinedNot Defined0.00CVE-2020-7679
08:14 AM6.76.7SAP EC-CUBE path traversal$5k-$25k$5k-$25kNot DefinedNot Defined0.00CVE-2020-5590
08:14 AM4.74.7IBM DOORS Next Generation Web UI cross site scriting$5k-$25k$0-$5kNot DefinedNot Defined0.00CVE-2020-4297
08:14 AM4.74.7IBM DOORS Next Generation Web UI cross site scriting$5k-$25k$0-$5kNot DefinedNot Defined0.00CVE-2020-4295
08:13 AM4.74.7IBM DOORS Next Generation Web UI cross site scriting$5k-$25k$0-$5kNot DefinedNot Defined0.05CVE-2020-4281
08:13 AM3.63.6Navigate CMS Alias cross site scripting$0-$5k$0-$5kNot DefinedNot Defined0.00CVE-2020-14927
08:13 AM4.44.4CMS Made Simple cross site scripting$0-$5k$0-$5kNot DefinedNot Defined0.00CVE-2020-14926
08:12 AM5.75.7Dolibarr ERP CRM notice.php Reflected cross site scripting$0-$5k$0-$5kNot DefinedNot Defined0.00CVE-2020-14475
08:12 AM5.45.1Octopus Deploy Deployment Password insufficiently protected credentials$0-$5k$0-$5kNot DefinedOfficial Fix0.06CVE-2020-14470
08:11 AM4.74.7Caldera Operation Name Box cross site scripting$0-$5k$0-$5kNot DefinedNot Defined0.05CVE-2020-14462
08:11 AM6.46.1Mattermost Server OAuth Application privileges management$0-$5k$0-$5kNot DefinedOfficial Fix0.07CVE-2020-14460
08:10 AM7.47.1Mattermost Server Channel input validation$0-$5k$0-$5kNot DefinedOfficial Fix0.09CVE-2020-14459
08:10 AM6.46.1Mattermost Server API information disclosure$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-14458
08:09 AM5.35.1Mattermost Server Websocket authorization$0-$5k$0-$5kNot DefinedOfficial Fix0.07CVE-2020-14457
08:09 AM7.37.0Mattermost Desktop App Same Origin Policy origin validation$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-14456
08:09 AM6.56.2Mattermost Desktop App HTTP Basic Authentication improper authentication$0-$5k$0-$5kNot DefinedOfficial Fix0.05CVE-2020-14455
08:08 AM6.66.3Mattermost Desktop App redirect$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-14454
08:08 AM6.46.1Mattermost Socket Read insufficient verification of data authenticity$0-$5k$0-$5kNot DefinedOfficial Fix0.08CVE-2020-14453
08:08 AM5.35.1Mattermost Server mmctl path traversal$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-14452
08:07 AM4.64.5Mattermost Mobile App Single Sign-On Cookie information disclosure$0-$5k$0-$5kNot DefinedOfficial Fix0.04CVE-2020-14451
08:07 AM6.46.1Mattermost Server Markdown Renderer denial of service$0-$5k$0-$5kNot DefinedOfficial Fix0.06CVE-2020-14450
08:07 AM6.46.1Mattermost Mobile App Authorization Token information disclosure$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-14449
08:06 AM6.46.1Mattermost Server Automatic Direct Message Reply infinite loop$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-14448
08:06 AM6.46.1Mattermost Server Webhook infinite loop$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2020-14447
08:05 AM8.58.5Open-iSCSI rtslib-fb Permission saveconfig.json default permission$0-$5k$0-$5kNot DefinedNot Defined0.03CVE-2020-14019
08:05 AM6.45.6strapi Email Template input validation$0-$5k$0-$5kNot DefinedOfficial Fix0.08CVE-2020-13961
08:04 AM5.35.1Mattermost Server Email information disclosure$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2019-20890
08:04 AM6.36.1Mattermost Server Permission default permission$0-$5k$0-$5kNot DefinedOfficial Fix0.06CVE-2019-20889
08:04 AM6.46.1Mattermost Server Webhook memory leak$0-$5k$0-$5kNot DefinedOfficial Fix0.02CVE-2019-20888
08:03 AM5.35.1Mattermost Server API Permission permission assignment$0-$5k$0-$5kNot DefinedOfficial Fix0.02CVE-2019-20887
08:03 AM6.26.0Mattermost Server User privileges management$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2019-20886
08:02 AM7.47.1Mattermost Server Robots File information disclosure$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2019-20885
08:02 AM6.36.1Mattermost Server Attachment permission assignment$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2019-20884
08:02 AM5.35.1Mattermost Server Town Square permission assignment$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2019-20883
08:01 AM6.36.1Mattermost Server Domain default permission$0-$5k$0-$5kNot DefinedOfficial Fix0.05CVE-2019-20882
08:01 AM5.55.3Mattermost Server MFA insufficiently protected credentials$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2019-20881
08:01 AM6.46.1Mattermost Server OpenGraph resource consumption$0-$5k$0-$5kNot DefinedOfficial Fix0.00CVE-2019-20880

Do you know our Splunk app?

Download it now for free!