Archive
February 2019
Vulnerabilities first published in this month (UTC), newest first.
847 results · Feed
-
Unscored —
Directory traversal vulnerability in HOUSE GATE App for iOS 1.7.8 and earlier allows remote attackers to read arbitrary…
-
Unscored —
Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch…
-
Medium 5.6
True Key Browser Extension 3.1.9219.0 update fixes Sensitive Data Exposure vulnerability
Data Leakage Attacks vulnerability in Microsoft Windows client in McAfee True Key (TK) 3.1.9211.0 and earlier allows local users to expose confidential data via specially crafted malware.
-
High 7.9
DSA-2019-022: Dell Wyse Password Encoder Hard-coded Cryptographic Key Vulnerability
The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover…
-
Medium 6.3
CredHub CLI writes environment variable credentials to disk
Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these…
-
Unscored —
An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XS…
-
Unscored —
An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid…
-
Medium 5.3
uap-core Regular Expression Denial of Service issue
An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value co…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a re…
-
Unscored —
In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a craft…
-
Unscored —
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition…
-
Unscored —
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition…
-
Unscored —
A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow ar…
-
Unscored —
Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, …
-
Unscored —
Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited whe…
-
Unscored —
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows a…
-
Unscored —
An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusio…
-
Unscored —
When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attack…
-
Unscored —CVE-2017-0938 EPSS 21%
Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Pr…
-
Unscored —
Solutions Business Manager (SBM) Authentication Bypass Issue in Version prior to 11.5
An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
-
Unscored —
ATTO FibreBridge 7500N firmware version 2.95 is susceptible to a vulnerability which allows attackers to cause a Denial…
-
Unscored —
In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" fun…
-
High 7.7
Cisco Network Assurance Engine CLI Access with Default Password Vulnerability
A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server. The vulnerability is due to a fault …
-
Unscored —
An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global C…
-
Unscored —
An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could le…
-
Critical 9.8
Joomla! Object Injection Vulnerability
An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
-
Unscored —
An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection wit…
-
Unscored —
An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed…
-
Unscored —
An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaLis…
-
Unscored —
An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Rel…
-
Unscored —
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned …
-
Unscored —
Registers used to store Modbus values can be read and written from the web interface without authentication in the PR10…
-
Unscored —
PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able …