Vulnetix
Try Vulnetix Request Demo
Google Security Advisories · January 2020 — Google Security Advisories
89 advisories 54 CVEs 10 EXPLOITED

GCVE / Google Cloud / Chrome / Android / Project Zero / OSS for 2020-01. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 10 are already weaponised in the wild.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2020-0601

GoogleExploitedCISA KEV listedCRITICAL2020-01-14

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, ...

CVEs:CVE-2020-0601

Affected products

ProductStatusVendorPackageEcosystem
go affected golang — —
windows_10_1507 affected microsoft — —
windows_10_1607 affected microsoft — —
windows_10_1709 affected microsoft — —
windows_10_1803 affected microsoft — —
windows_10_1809 affected microsoft — —
windows_10_1903 affected microsoft — —
windows_10_1909 affected microsoft — —
windows_server_1803 affected microsoft — —
windows_server_1903 affected microsoft — —
windows_server_1909 affected microsoft — —
windows_server_2016 affected microsoft — —
windows_server_2019 affected microsoft — —
Upstream advisory

CVE-2020-0674

GoogleExploitedCISA KEV listedCRITICAL2020-01-20

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-...

CVEs:CVE-2020-0674

Affected products

ProductStatusVendorPackageEcosystem
internet_explorer affected microsoft — —
Upstream advisory

CVE-2020-0674

Project ZeroExploitedCISA KEV listed2020-01-20

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.

CVEs:CVE-2020-0674

Upstream advisory

CVE-2019-17026

GoogleExploitedCISA KEV listedHIGH2020-01-09

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and ...

CVEs:CVE-2019-17026

Affected products

ProductStatusVendorPackageEcosystem
firefox affected mozilla — —
thunderbird affected mozilla — —
ubuntu_linux affected canonical — —
Upstream advisory

CVE-2019-17026

Project ZeroExploitedCISA KEV listed2020-01-09

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

CVEs:CVE-2019-17026

Upstream advisory

CVE-2020-0009

Open SourceWeaponized exploitMEDIUM2020-01-08

In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges ...

CVEs:CVE-2020-0009

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
debian_linux affected debian — —
Upstream advisory

CVE-2013-6792

Open SourceActive exploitation (sightings)CRITICAL2020-01-23

Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability

CVEs:CVE-2013-6792

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

DSA-4606-1

Open SourcePoC exploit2020-01-20

chromium - security update

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:10 chromium —
Upstream advisory

openSUSE-SU-2020:0010-1

Open SourcePoC exploitCRITICAL2020-01-13

Security update for chromium, re2

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 15 SP1 chromium —
re2 affected SUSE:Package Hub 15 SP1 re2 —
Upstream advisory

DEBIAN-CVE-2019-14863

Open SourcePoC exploitMEDIUM2020-01-02

DEBIAN-CVE-2019-14863

Affected products

ProductStatusVendorPackageEcosystem
angular.js affected Debian:11 angular.js —
angular.js affected Debian:12 angular.js —
angular.js affected Debian:13 angular.js —
angular.js affected Debian:14 angular.js —
Upstream advisory

CVE-2019-14863

Open SourcePoC exploitMEDIUM2020-01-02

AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

CVEs:CVE-2019-14863

Affected products

ProductStatusVendorPackageEcosystem
angular affected npm angular —
Upstream advisory

CVE-2019-14863

Open SourcePoC exploitMEDIUM2020-01-02

AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

CVEs:CVE-2019-14863

Affected products

ProductStatusVendorPackageEcosystem
angular affected npm angular —
Upstream advisory

CVE-2019-14863

Open SourcePoC exploitHIGH2020-01-02

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

CVEs:CVE-2019-14863

Affected products

ProductStatusVendorPackageEcosystem
angularjs affected angularjs — —
decision_manager affected redhat — —
process_automation affected redhat — —
Upstream advisory

CVE-2020-0001

Open SourcePoC exploitHIGH2020-01-08

In getProcessRecordLocked of ActivityManagerService.java isolated apps are not handled correctly. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product:...

CVEs:CVE-2020-0001

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

openSUSE-SU-2020:0007-1

Open SourceCoalition ESS < 30%CRITICAL2020-01-11

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 15 SP1 chromium —
Upstream advisory

DEBIAN-CVE-2019-13767

Open SourceCoalition ESS < 30%CRITICAL2020-01-10

DEBIAN-CVE-2019-13767

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:11 chromium —
chromium affected Debian:12 chromium —
chromium affected Debian:13 chromium —
chromium affected Debian:14 chromium —
Upstream advisory

openSUSE-SU-2020:0045-1

Open SourceCoalition ESS < 30%NONE2020-01-13

Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

Affected products

ProductStatusVendorPackageEcosystem
containerd affected openSUSE:Leap 15.1 containerd —
docker affected openSUSE:Leap 15.1 docker —
docker-runc affected openSUSE:Leap 15.1 docker-runc —
golang-github-docker-libnetwork affected openSUSE:Leap 15.1 golang-github-docker-libnetwork —
Upstream advisory

SUSE-SU-2020:0065-1

Open SourceCoalition ESS < 30%NONE2020-01-10

Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

Affected products

ProductStatusVendorPackageEcosystem
containerd affected SUSE:Linux Enterprise Module for Containers 12 containerd —
docker affected SUSE:Linux Enterprise Module for Containers 12 docker —
docker-runc affected SUSE:Linux Enterprise Module for Containers 12 docker-runc —
golang-github-docker-libnetwork affected SUSE:Linux Enterprise Module for Containers 12 golang-github-docker-libnetwork —
Upstream advisory

SUSE-SU-2020:0035-1

Open SourceCoalition ESS < 30%NONE2020-01-08

Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

Affected products

ProductStatusVendorPackageEcosystem
containerd affected SUSE:Linux Enterprise Module for Containers 15 SP1 containerd —
containerd affected SUSE:Linux Enterprise Module for Containers 15 containerd —
docker affected SUSE:Linux Enterprise Module for Containers 15 docker —
docker affected SUSE:Linux Enterprise Module for Containers 15 SP1 docker —
docker-runc affected SUSE:Linux Enterprise Module for Containers 15 SP1 docker-runc —
docker-runc affected SUSE:Linux Enterprise Module for Containers 15 docker-runc —
golang-github-docker-libnetwork affected SUSE:Linux Enterprise Module for Containers 15 SP1 golang-github-docker-libnetwork —
golang-github-docker-libnetwork affected SUSE:Linux Enterprise Module for Containers 15 golang-github-docker-libnetwork —
Upstream advisory

CVE-2020-5219

Open SourceCoalition ESS < 30%CRITICAL2020-01-24

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an atta...

CVEs:CVE-2020-5219

Affected products

ProductStatusVendorPackageEcosystem
angular-expressions affected peerigon — —
Upstream advisory

CVE-2020-5219

Open SourceCoalition ESS < 30%HIGH2020-01-24

Remote Code Execution in Angular Expressions

CVEs:CVE-2020-5219

Affected products

ProductStatusVendorPackageEcosystem
angular-expressions affected npm angular-expressions —
Upstream advisory

CVE-2020-5219

Open SourceCoalition ESS < 30%HIGH2020-01-24

Remote Code Execution in Angular Expressions

CVEs:CVE-2020-5219

Affected products

ProductStatusVendorPackageEcosystem
angular-expressions affected npm angular-expressions —
Upstream advisory

GHSA-hxhm-96pp-2m43

Open SourceCoalition ESS < 30%HIGH2020-01-24

Remote Code Execution in Angular Expressions

Affected products

ProductStatusVendorPackageEcosystem
angular-expressions affected npm angular-expressions —
Upstream advisory

GHSA-hxhm-96pp-2m43

Open SourceCoalition ESS < 30%HIGH2020-01-24

Remote Code Execution in Angular Expressions

Affected products

ProductStatusVendorPackageEcosystem
angular-expressions affected npm angular-expressions —
Upstream advisory

openSUSE-SU-2020:0053-1

Open SourceCoalition ESS < 30%CRITICAL2020-01-14

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 15 SP1 chromium —
re2 affected SUSE:Package Hub 15 SP1 re2 —
Upstream advisory

openSUSE-SU-2020:0009-1

Open SourceCoalition ESS < 30%CRITICAL2020-01-12

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 15 SP1 chromium —
re2 affected SUSE:Package Hub 15 SP1 re2 —
Upstream advisory

openSUSE-SU-2020:0006-1

Open SourceCoalition ESS < 30%CRITICAL2020-01-11

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected openSUSE:Leap 15.1 chromium —
re2 affected openSUSE:Leap 15.1 re2 —
Upstream advisory

DEBIAN-CVE-2020-6377

Open SourceCoalition ESS < 30%CRITICAL2020-01-10

DEBIAN-CVE-2020-6377

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:12 chromium —
chromium affected Debian:11 chromium —
chromium affected Debian:13 chromium —
chromium affected Debian:14 chromium —
Upstream advisory

CVE-2020-6377

GoogleCoalition ESS < 30%CRITICAL2020-01-10

Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2020-6377

Affected products

ProductStatusVendorPackageEcosystem
backports_sle affected opensuse — —
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_workstation affected redhat — —
fedora affected fedoraproject — —
leap affected opensuse — —
Upstream advisory

openSUSE-SU-2020:0004-1

Open SourceCoalition ESS < 30%CRITICAL2020-01-10

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 15 SP1 chromium —
chromium affected SUSE:Package Hub 12 SP3 chromium —
Upstream advisory

DEBIAN-CVE-2019-5844

Open SourceCoalition ESS < 30%MEDIUM2020-01-03

DEBIAN-CVE-2019-5844

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:11 chromium —
chromium affected Debian:12 chromium —
chromium affected Debian:13 chromium —
chromium affected Debian:14 chromium —
Upstream advisory

DEBIAN-CVE-2019-5845

Open SourceCoalition ESS < 30%MEDIUM2020-01-03

DEBIAN-CVE-2019-5845

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:11 chromium —
chromium affected Debian:12 chromium —
chromium affected Debian:13 chromium —
chromium affected Debian:14 chromium —
Upstream advisory

DEBIAN-CVE-2019-5846

Open SourceCoalition ESS < 30%MEDIUM2020-01-03

DEBIAN-CVE-2019-5846

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:11 chromium —
chromium affected Debian:12 chromium —
chromium affected Debian:13 chromium —
chromium affected Debian:14 chromium —
Upstream advisory

CVE-2019-5845

GoogleCoalition ESS < 30%MEDIUM2020-01-03

Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2019-5845

Affected products

ProductStatusVendorPackageEcosystem
backports_sle affected opensuse — —
chrome affected google — —
leap affected opensuse — —
Upstream advisory

CVE-2019-5846

GoogleCoalition ESS < 30%MEDIUM2020-01-03

Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2019-5846

Affected products

ProductStatusVendorPackageEcosystem
backports_sle affected opensuse — —
chrome affected google — —
leap affected opensuse — —
Upstream advisory

CVE-2019-5844

GoogleCoalition ESS < 30%MEDIUM2020-01-03

Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2019-5844

Affected products

ProductStatusVendorPackageEcosystem
backports_sle affected opensuse — —
chrome affected google — —
leap affected opensuse — —
Upstream advisory

CVE-2020-0002

Open SourceCoalition ESS < 30%HIGH2020-01-08

In ih264d_init_decoder of ih264d_api.c, there is a possible out of bounds write due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation Product: Andro...

CVEs:CVE-2020-0002

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

openSUSE-SU-2020:0093-1

Open SourceCoalition ESS < 30%CRITICAL2020-01-22

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 12 SP3 chromium —
chromium affected SUSE:Package Hub 15 SP1 chromium —
chromium affected openSUSE:Leap 15.1 chromium —
Upstream advisory

CVE-2020-6378

GoogleCoalition ESS < 30%CRITICAL2020-01-17

Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2020-6378

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
fedora affected fedoraproject — —
Upstream advisory

CVE-2020-6380

GoogleCoalition ESS < 30%CRITICAL2020-01-17

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension.

CVEs:CVE-2020-6380

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
fedora affected fedoraproject — —
Upstream advisory

CVE-2020-6379

GoogleCoalition ESS < 30%CRITICAL2020-01-17

Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2020-6379

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
fedora affected fedoraproject — —
Upstream advisory

CVE-2020-0006

Open SourceCoalition ESS < 30%MEDIUM2020-01-08

In rw_i93_send_cmd_write_single_block of rw_i93.cc, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to remote information disclosure in the NFC server with no additional execution privileges needed. ...

CVEs:CVE-2020-0006

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

DEBIAN-CVE-2019-13765

Open SourceCoalition ESS < 30%CRITICAL2020-01-03

DEBIAN-CVE-2019-13765

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:12 chromium —
chromium affected Debian:11 chromium —
chromium affected Debian:13 chromium —
chromium affected Debian:14 chromium —
Upstream advisory

CVE-2019-13765

GoogleCoalition ESS < 30%CRITICAL2020-01-03

Use-after-free in content delivery manager in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2019-13765

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

DEBIAN-CVE-2019-13766

Open SourceCoalition ESS < 30%CRITICAL2020-01-03

DEBIAN-CVE-2019-13766

Affected products

ProductStatusVendorPackageEcosystem
chromium affected Debian:12 chromium —
chromium affected Debian:14 chromium —
chromium affected Debian:11 chromium —
chromium affected Debian:13 chromium —
Upstream advisory

CVE-2019-13766

GoogleCoalition ESS < 30%CRITICAL2020-01-03

Use-after-free in accessibility in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2019-13766

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

PYSEC-2020-258

Open SourceCoalition ESS < 30%HIGH2020-01-28

PYSEC-2020-258

Affected products

ProductStatusVendorPackageEcosystem
tensorflow affected PyPI tensorflow —
Upstream advisory

PYSEC-2020-303

Open SourceCoalition ESS < 30%HIGH2020-01-28

PYSEC-2020-303

Affected products

ProductStatusVendorPackageEcosystem
tensorflow-cpu affected PyPI tensorflow-cpu —
Upstream advisory

PYSEC-2020-338

Open SourceCoalition ESS < 30%HIGH2020-01-28

PYSEC-2020-338

Affected products

ProductStatusVendorPackageEcosystem
tensorflow-gpu affected PyPI tensorflow-gpu —
Upstream advisory

GHSA-977j-xj7q-2jr9

Open SourceCoalition ESS < 30%HIGH2020-01-28

Segmentation faultin TensorFlow when converting a Python string to `tf.float16`

Affected products

ProductStatusVendorPackageEcosystem
tensorflow affected PyPI tensorflow —
tensorflow-cpu affected PyPI tensorflow-cpu —
tensorflow-gpu affected PyPI tensorflow-gpu —
Upstream advisory

GHSA-977j-xj7q-2jr9

Open SourceCoalition ESS < 30%HIGH2020-01-28

Segmentation faultin TensorFlow when converting a Python string to `tf.float16`

Affected products

ProductStatusVendorPackageEcosystem
tensorflow affected PyPI tensorflow —
tensorflow affected PyPI tensorflow —
tensorflow-cpu affected PyPI tensorflow-cpu —
tensorflow-cpu affected PyPI tensorflow-cpu —
tensorflow-gpu affected PyPI tensorflow-gpu —
tensorflow-gpu affected PyPI tensorflow-gpu —
Upstream advisory

CVE-2020-5215

Open SourceCoalition ESS < 30%MEDIUM2020-01-28

PYSEC-2020-338

CVEs:CVE-2020-5215

Affected products

ProductStatusVendorPackageEcosystem
tensorflow affected PyPI tensorflow —
tensorflow-cpu affected PyPI tensorflow-cpu —
tensorflow-gpu affected PyPI tensorflow-gpu —
Upstream advisory

CVE-2020-5215

Open SourceCoalition ESS < 30%HIGH2020-01-28

Segmentation faultin TensorFlow when converting a Python string to `tf.float16`

CVEs:CVE-2020-5215

Affected products

ProductStatusVendorPackageEcosystem
tensorflow affected PyPI tensorflow —
tensorflow-cpu affected PyPI tensorflow-cpu —
tensorflow-gpu affected PyPI tensorflow-gpu —
Upstream advisory

CVE-2020-5215

Open SourceCoalition ESS < 30%HIGH2020-01-28

In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in ...

CVEs:CVE-2020-5215

Affected products

ProductStatusVendorPackageEcosystem
tensorflow affected google — —
Upstream advisory

CVE-2020-0007

Open SourceCoalition ESS < 30%MEDIUM2020-01-08

In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exp...

CVEs:CVE-2020-0007

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2020-0004

Open SourceCoalition ESS < 30%MEDIUM2020-01-08

In generateCrop of WallpaperManagerService.java, there is a possible sysui crash due to image exceeding maximum texture size. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for ...

CVEs:CVE-2020-0004

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2020-0003

Open SourceCoalition ESS < 30%MEDIUM2020-01-08

In onCreate of InstallStart.java, there is a possible package validation bypass due to a time-of-check time-of-use vulnerability. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is neede...

CVEs:CVE-2020-0003

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2020-0008

Open SourceCoalition ESS < 30%MEDIUM2020-01-08

In LowEnergyClient::MtuChangedCallback of low_energy_client.cc, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not need...

CVEs:CVE-2020-0008

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2018-1002104

Open SourceEPSS <= 49%MEDIUM2020-01-14

Kubernetes ingress exposes sensitive information

CVEs:CVE-2018-1002104

Affected products

ProductStatusVendorPackageEcosystem
ingress-nginx affected k8s.io k8s.io/ingress-nginx —
Upstream advisory

CVE-2018-1002104

GoogleEPSS <= 49%MEDIUM2020-01-14

Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.

CVEs:CVE-2018-1002104

Affected products

ProductStatusVendorPackageEcosystem
nginx_ingress_controller affected kubernetes — —
Upstream advisory

CVE-2014-7238

GoogleEPSS <= 49%CRITICAL2020-01-23

The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS

CVEs:CVE-2014-7238

Affected products

ProductStatusVendorPackageEcosystem
contact_form_integrated_with_google_maps affected formget — —
Upstream advisory

CVE-2015-1530

Open SourceEPSS <= 49%CRITICAL2020-01-24

media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of service (integer overflow) via a crafted application that provides an invalid array size.

CVEs:CVE-2015-1530

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2015-1525

Open SourceEPSS <= 49%HIGH2020-01-24

audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio_policy application outage) via a crafted application that provides a NULL device address.

CVEs:CVE-2015-1525

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console