Archive
January 2019
Vulnerabilities first published in this month (UTC), newest first.
97 results · Clear filters · Feed
-
High 7.2CVE-2017-3141 Public exploit
Windows service and uninstall paths are not quoted when BIND is installed
The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.…
-
High 8.1
Improper Access Control in MySQL Connector Python
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network acce…
-
High 7.8
Juniper ATP: API and device keys are logged in a world-readable permissions file
On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
-
High 8.8
Juniper ATP: Splunk credentials are in logged in clear text
Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
-
High 7.5
Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd).
Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeat…
-
High 7.1
Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text
On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.
-
High 7.5
Junos OS: QFX and PTX Series: FPC process crashes after J-Flow processes a malformed packet
On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC pro…
-
High 7.5
Junos OS: rpd crash on VPLS PE upon receipt of specific BGP message
A Denial of Service (DoS) vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, r…
-
High 7.5
Junos OS: SRX Series: Crafted HTTP traffic may cause UTM to consume all mbufs, leading to Denial of Service
An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a system crash with the error message "mbuf exceed" -- an indication of memory buffer exhaustion -- due to the receipt of crafted HTTP traffic. Each crafted HTTP packe…
-
High 7.5
Junos OS: A flowspec BGP update with a specific term-order causes routing protocol daemon (rpd) process to crash with a core.
When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash wi…
-
High 7.4
REST API can bypass comment approval - Access Bypass - Moderately Critical
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web…
-
High 8.8
Shopware SQL Injection
Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.
-
High 8.8
PrestaShop PHP Object Injection
In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process …
-
High 7.7
elFinder Server Side Request Forgery (SSRF)
A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.
-
High 7.5
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discove…
-
High 7.4
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discove…
-
High 8.8
In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improv…
-
High 8.6
Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (Do…
-
High 8.6
Cisco Email Security Appliance Memory Corruption Denial of Service Vulnerability
A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting features of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke…
-
High 7.1
An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to imp…
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inpu…
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to imp…
-
High 7.3
Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent Software Redis Server Unauthenticated Access Vulnerability
A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an unauthenticated, remote attacker to modify key-value pairs for short-lived events stored by the Redis s…
-
High 7.8
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java t…
-
High 7.8
Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk
An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the p…
-
High 7.8
Jenkins SonarQube Scanner Plugin stored server authentication token in plain text
An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.
-
High 8.8
Jenkins HipChat Plugin allows credential capture due to incorrect authorization
An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified creden…
-
High 7.8
Jenkins Crowd 2 Integration Plugin stored credentials in plain text
An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used …
-
High 8.1
CSRF vulnerability in Config File Provider Plugin
A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.
-
High 8.1
CSRF vulnerability in Email Extension Template Plugin
A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.