Archive
20 February 2019
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
High 8.8
Cisco HyperFlex Software Command Injection Vulnerability
A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulner…
-
Medium 6.5CVE-2019-3474 Public exploit
Path traversal vulnerability in Filr web application
A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior …
-
High 7.8CVE-2019-3475 Public exploit
Local privilege escalation in Filr famtd
A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
-
Medium 4.3
SSRF vulnerability due to missing permission check in Jenkins JMS Messaging Plugin
A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a …
-
Medium 4.3
Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information
A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specifi…
-
Medium 4.3
SSRF vulnerability due to missing permission check in Jenkins OctopusDeploy Plugin
A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP respon…
-
High 8.8
Jenkins Script Security Plugin sandbox bypass vulnerability
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code …
-
Medium 4.3
Jenkins Mattermost Notification Plugin vulnerable to SSRF
A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and…
-
Unscored —
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The s…
-
Unscored —
A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw…
-
Unscored —
An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can …
-
Unscored —
An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be…
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module.
-
Unscored —
An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be expl…
-
Unscored —
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parame…
-
Medium 6.1
Bootstrap Vulnerable to Cross-Site Scripting
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
-
Unscored —
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, r…
-
Unscored —
The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to…
-
Unscored —
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers …
-
Unscored —
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
-
Unscored —
The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to lo…
-
Unscored —
An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 …
-
Unscored —
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry c…
-
Unscored —
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can…
-
Unscored —
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959.
-
Critical 9.8
SQLAlchemy vulnerable to SQL Injection via order_by parameter
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.