Skip to content
OpenAdvisories

Archive

February 2019

Vulnerabilities first published in this month (UTC), newest first.

← January 2019 2019 / February March 2019 →
  1. 126
  2. 2 
  3. 34
  4. 471
  5. 566
  6. 653
  7. 735
  8. 818
  9. 914
  10. 1016
  11. 1147
  12. 1235
  13. 1342
  14. 141
  15. 1531
  16. 165
  17. 1730
  18. 1843
  19. 1938
  20. 2031
  21. 2135
  22. 2216
  23. 2331
  24. 2412
  25. 2555
  26. 2619
  27. 2719
  28. 2854
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Critical 9.8
    CVE-2019-1663 Public exploit EPSS 96%

    Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability

    A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary co…

    Cisco RV130W Wireless-N Multifunction VPN Router RV110W Wireless-N VPN Firewall RV215W Wireless-N VPN Router Network devices
  • Critical 9.8
    CVE-2019-9212

    Incomplete List of Disallowed Inputs in SOFA-Hessian

    SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadg…

    com.alipay.sofa:hessian Maven
  • Critical 9.8
    CVE-2019-9201

    Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive inf…

  • Critical 9.8
    CVE-2019-9194 Public exploit Scanner template EPSS 97%

    elFinder command injection vulnerability in the PHP connector

    elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

    studio-42/elfinder Packagist
  • Critical 9.8
    CVE-2019-9115

    irisnet-crypto RCE Vulnerability

    In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage.

    irisnet-crypto npm
  • Critical 9.8
    CVE-2019-7164

    SQLAlchemy vulnerable to SQL Injection via order_by parameter

    SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

    sqlalchemy sqlalchemy sqlalchemy Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2019-7743

    Joomla! Object Injection Vulnerability

    An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

    joomla/joomla-cms Packagist
  • Critical 9.0
    CVE-2019-4008

    API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result i…

    IBM API Connect
  • Critical 9.1
    CVE-2019-1003015

    XXE vulnerability in Jenkins Job Import Plugin

    An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried…

    Jenkins Project Jenkins Job Import Plugin org.jenkins-ci.plugins:job-import-plugin Web / CMS Maven
  • Critical 10.0
    CVE-2018-3991 EPSS 34%

    An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, v…

  • Critical 9.3
    CVE-2018-3990

    An exploitable pool corruption vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuK…

  • Critical 9.1
    CVE-2018-4056

    An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4…

    Talos coTURN coturn coturn Debian Ubuntu
  • Critical 9.8
    CVE-2016-1000282 Public exploit EPSS 13%

    Critical severity vulnerability that affects Haraka

    Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

    Haraka npm
  • Critical 9.8
    CVE-2018-20753 Exploited · Ransomware EPSS 30%

    Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers…

    KEV Apr 13, 2022
  • Critical 9.8
    CVE-2017-18362 Exploited · Ransomware Scanner template EPSS 87%

    ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that…

    KEV May 24, 2022
  • Critical 9.8
    CVE-2019-1000001

    TeamPass Storing Passwords in a Recoverable Format vulnerability

    TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability t…

    nilsteampassnet/teampass Packagist
  • Critical 9.8
    CVE-2018-16486

    Prototype Pollution in defaults-deep

    A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

    HackerOne defaults-deep defaults-deep npm
  • Critical 9.8
    CVE-2018-16491

    Prototype Pollution in node.extend

    A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

    HackerOne node.extend node-extend node-extend Debian Ubuntu npm
  • Critical 9.8
    CVE-2018-16489

    Prototype Pollution in just-extend

    A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.

    HackerOne just-extend just-extend npm