Archive
January 2019
Vulnerabilities first published in this month (UTC), newest first.
1,214 results · Feed
-
Unscored —CVE-2019-7297 EPSS 12%
An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability all…
-
Unscored —
The product CMS-770 (Software Versions 1.7.1 and prior)is vulnerable that an attacker can read sensitive configuration …
-
Critical 10.0
Guardzilla All-In-One Video Security System Hard-Coded Credential
A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol's Guardzilla All-In-One Video Security System allows an attacker to view the private data of all users of the Guardzilla device.
-
Unscored —
typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formul…
-
Unscored —
typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formu…
-
Unscored —
In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public…
-
Unscored —
NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the reg…
-
Unscored —
In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discoveri…
-
Unscored —
servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary pa…
-
Unscored —
The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.d…
-
Unscored —
The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT comm…
-
Unscored —CVE-2018-15517 EPSS 44%
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to a…
-
Unscored —
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename…
-
Unscored —CVE-2018-19041 Public exploit
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to th…
-
Unscored —
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir par…
-
Unscored —
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the d…
-
Unscored —
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via th…
-
Unscored —
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories…
-
Unscored —
The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker…
-
Unscored —
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating …
-
Medium 6.1
IBM I 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript …
-
Unscored —
In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a deni…
-
Unscored —
An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the config…
-
Unscored —
In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and wou…
-
Unscored —CVE-2019-7216 Public exploit
An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user…
-
Unscored —
SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems.
-
Medium 6.8
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-…
-
Medium 6.8
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (…
-
Medium 5.9
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses w…
-
Unscored —CVE-2018-17189 EPSS 19%
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …
-
Unscored —CVE-2018-17199 EPSS 20%
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the sess…
-
Medium 6.8CVE-2018-3956 EPSS 46%
An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Softw…
-
Unscored —CVE-2019-0190 EPSS 60%
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request…
-
Unscored —
In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference.
-
Unscored —
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/..…
-
Unscored —
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/..…
-
Unscored —
An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManag…
-
Unscored —
An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do…
-
Unscored —
The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earli…
-
Unscored —
The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlie…