Archive
3 January 2019
Vulnerabilities first published on this day (UTC), newest first.
58 results · Feed
-
Critical 9.0
An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK.…
-
Medium 4.2
An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android …
-
Unscored —
The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-201610040843…
-
Unscored —
An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information D…
-
Unscored —
An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. They allowed Denial of Service (applicati…
-
Unscored —
An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is a NULL pointer dereference during P…
-
Unscored —
Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be config…
-
Unscored —
Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker us…
-
Unscored —
The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens…
-
Medium 4.3
DSA-2018-224: RSA Archer GRC Platform Improper Access Control Vulnerability
RSA Archer versions prior to 6.5.0.1 contain an improper access control vulnerability. A remote malicious user could potentially exploit this vulnerability to bypass authorization checks and gain read access to restricted user information.
-
Unscored —
Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X…
-
Unscored —
Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows r…
-
Unscored —
Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remot…
-
Unscored —
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
-
Unscored —
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
-
Medium 6.1
Dolibarr reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.
-
Unscored —
Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, …
-
Unscored —
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST r…
-
Medium 5.4
Dolibarr stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to user/card.php.
-
Medium 5.4
Dolibarr stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to adherents/type.php.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web …
-
Unscored —
DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL (0x80002068) with a user…
-
High 8.8
Dolibarr SQL injection vulnerability in user/card.php
SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter.
-
High 8.8
Dolibarr error-based SQL injection vulnerability in product/card.php
An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter.
-
Unscored —
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD r…
-
Unscored —
Multiple SQL injection vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via…
-
Unscored —
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.
-
Unscored —
EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and t…
-
High 7.8
sqla-yaml-fixtures is vulnerable to Code Injection
Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.
-
Unscored —
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
-
Medium 5.4
The Reporting Addon for CUBA Platform has Persistent XSS
The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.
-
Unscored —
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
-
Unscored —
In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient valida…
-
Unscored —
It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrad…
-
Medium 6.1
A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=…
-
Medium 4.7
A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with…
-
Unscored —
An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modificati…
-
Low 3.1
Ansible sensitive information disclosure
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
-
Unscored —
Information leak in UIM API debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM96…
-
Unscored —
Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206,…