Archive
January 2019
Vulnerabilities first published in this month (UTC), newest first.
1,214 results · Feed
-
Unscored —
Improper directory permissions in the ZeroConfig service in Intel(R) PROSet/Wireless WiFi Software before version 20.90…
-
Unscored —
Insufficient write protection in firmware for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a pri…
-
Unscored —
Improper directory permissions in the installer for the Intel(R) SSD Data Center Tool for Windows before v3.0.17 may al…
-
Unscored —
Improper setting of device configuration in system firmware for Intel(R) NUC kits may allow a privileged user to potent…
-
Unscored —
Insufficient path checking in Intel(R) System Support Utility for Windows before 2.5.0.15 may allow an authenticated us…
-
Medium 6.1
Cisco Prime Infrastructure Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The …
-
Medium 5.3
Cisco Firepower Management Center Disk Utilization Denial of Service Vulnerability
A vulnerability in the Shell Access Filter feature of Cisco Firepower Management Center (FMC), when used in conjunction with remote authentication, could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of servic…
-
Medium 5.3
Cisco IOS and IOS XE Software Secure Shell Connection on VRF Vulnerability
A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual routing and forwarding (VRF) instance despite the absence of the vrf-also keyword in the access-class co…
-
Unscored —
In CIMTechniques CIMScan 6.x through 6.2, the SOAP WSDL parser allows attackers to execute SQL code.
-
Medium 4.3
Cisco Identity Services Engine Password Recovery Vulnerability
A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text. The vulnerability is due to the incorrect inclusion of saved passwords when loading configuration …
-
High 8.6
Cisco Email Security Appliance Memory Corruption Denial of Service Vulnerability
A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting features of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke…
-
Medium 5.4
Cisco Prime Network Control System Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. The vul…
-
Medium 4.6
Cisco Jabber Client Framework Instant Message Cross-Site Scripting Vulnerability
A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient validation of user-supplied inpu…
-
Unscored —
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.
-
Unscored —
bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x be…
-
Medium 4.3
Cisco Unified Communications Manager Digest Credentials Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in con…
-
Medium 5.1
Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability
A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to corrupt arbitrary files on an affected device that has elevated privileges. The vulnerab…
-
Medium 6.5
Cisco IP Phone 8800 Series Arbitrary Script Injection Vulnerability
A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exists because the software running on an affected device insuf…
-
High 7.1
An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to imp…
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inpu…
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. …
-
High 7.1
The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to …
-
High 7.1
An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to imp…
-
Unscored —
An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not…
-
Unscored —
An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation l…
-
Medium 5.9
Sensitive Data Exposure in elFinder
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.
-
Unscored —
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allow…
-
Medium 6.8
Cisco IOS and IOS XE Software TCP Denial of Service Vulnerability
A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a state condition between the socket state and the transmission control …
-
High 7.3
Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent Software Redis Server Unauthenticated Access Vulnerability
A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an unauthenticated, remote attacker to modify key-value pairs for short-lived events stored by the Redis s…
-
Medium 5.3
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filena…
-
Medium 6.5
Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability
An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specifi…
-
Medium 6.5
Jenkins JUnit Plugin CSRF vulnerability
A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.