Archive
February 2019
Vulnerabilities first published in this month (UTC), newest first.
46 results · Clear filters · Feed
-
High 7.8CVE-2019-1674 Public exploit
Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability
A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient …
-
Critical 9.8
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary co…
-
Unscored —CVE-2019-1999 Public exploit
In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead t…
-
Unscored —CVE-2019-2000 Public exploit
In several functions of binder.c, there is possible memory corruption due to a use after free. This could lead to local…
-
Medium 5.3
IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the up…
-
Critical 9.8
elFinder command injection vulnerability in the PHP connector
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
-
Unscored —CVE-2019-9184 Public exploit
SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbit…
-
Unscored —CVE-2019-9162 Public exploit
In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient…
-
High 8.8
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public…
KEV Nov 3, 2021 -
Unscored —
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other product…
-
Unscored —
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filte…
-
Unscored —CVE-2014-10078 Public exploit
Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregf…
-
Unscored —CVE-2014-10079 Public exploit
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hi…
-
Medium 4.9CVE-2019-1698 Public exploit
Cisco IoT Field Network Director XML External Entity Vulnerability
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is d…
-
High 8.1
Drupal core - Highly critical - Remote Code Execution
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions …
KEV Mar 25, 2022 -
Unscored —
On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a sta…
-
Unscored —
com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent…
-
Unscored —CVE-2019-8979 Public exploit
Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled.
-
Medium 6.5CVE-2019-3474 Public exploit
Path traversal vulnerability in Filr web application
A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior …
-
High 7.8CVE-2019-3475 Public exploit
Local privilege escalation in Filr famtd
A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
-
Unscored —
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The s…
-
Medium 6.1
Bootstrap Vulnerable to Cross-Site Scripting
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
-
Unscored —
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, r…
-
Unscored —
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry c…
-
Unscored —
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can…
-
Unscored —
Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute ar…
-
High 7.5
Path Traversal in total.js
index.js in Total.js Platform before 3.2.3 allows path traversal.
-
Unscored —
mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The …
-
Unscored —
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
-
High 7.5
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via …
KEV Nov 3, 2021 -
Unscored —CVE-2019-8389 Public exploit
A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application ru…
-
Unscored —
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because…
-
Unscored —
An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) wher…
-
Unscored —
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition…
-
Unscored —
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition…
-
Unscored —CVE-2019-5596 Public exploit
In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEA…
-
Unscored —
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc …
-
Medium 5.4CVE-2018-16890 Public exploit
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …
-
High 8.8
Sandbox Bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script…
-
Unscored —CVE-2018-18333 Public exploit
A DLL hijacking vulnerability in Trend Micro Security 2019 (Consumer) versions below 15.0.0.1163 and below could allow …