Archive
6 February 2019
Vulnerabilities first published on this day (UTC), newest first.
53 results · Feed
-
Unscored —
A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3…
-
Unscored —
A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code e…
-
Unscored —
A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.
-
Unscored —
A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build…
-
Unscored —
A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pc…
-
Unscored —
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-boun…
-
Unscored —
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-boun…
-
Unscored —
GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c i…
-
Unscored —
GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/m…
-
High 8.8
An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0. A specially cr…
-
High 8.8
An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. A specially c…
-
High 8.8
An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5…
-
High 7.8
SQLAlchemy is vulnerable to SQL Injection via group_by parameter
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
-
Unscored —
In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability…
-
Unscored —
An issue was discovered in SIDU 6.0. The dbs parameter of the conn.php page has a reflected Cross-site Scripting (XSS) …
-
Unscored —CVE-2019-7543 Scanner template
In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
-
Unscored —
An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name…
-
Unscored —
An issue was discovered in MyWebSQL 3.7. The Add User function of the User Manager pages has a Stored Cross-site Script…
-
Unscored —
BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November…
-
Medium 5.4CVE-2018-16890 Public exploit
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …
-
High 7.1CVE-2019-3822 EPSS 13%
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an…
-
Medium 4.3
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-…
-
Medium 6.3
A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could by…
-
Medium 4.8
It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actio…
-
Unscored —
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a …
-
Unscored —
Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell …
-
Unscored —
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restr…
-
Unscored —
Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. The module automate…
-
Unscored —
This module provides a field on user profiles which allows users to get a notification when their account logs in to th…
-
Medium 6.1
MODX Revolution allows XSS through extended user fields
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
-
Medium 5.4
MODX vulnerability allows for XSS via user settings parameters
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
-
Medium 6.1
MODX Revolution vulnerable to XSS attack through its User Photo field
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
-
Medium 6.1
MODX Revolution allows XSS via document resources
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
-
Medium 4.3
Cross-Site Request Forgery in Jenkins Git Plugin
A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.
-
Medium 4.3
Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form
An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser …
-
High 8.8
Sandbox Bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script…
-
Medium 6.5
Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS
An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/j…
-
Medium 6.5
Jenkins Monitoring Plugin vulnerable to Denial of service vulnerability
A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.
-
Medium 5.4
Cross-site Scripting in Jenkins Blue Ocean Plugin
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/Expo…
-
Medium 5.3
Jenkins Job Import Plugin CSRF vulnerability
A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the impor…