Archive
February 2019
Vulnerabilities first published in this month (UTC), newest first.
847 results · Feed
-
Medium 5.3
IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be …
-
Low 3.7
IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificat…
-
Medium 5.4
IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could …
-
Unscored —
In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortco…
-
Unscored —
The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.
-
Unscored —
On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vul…
-
Unscored —CVE-2018-11803 EPSS 58%
Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uni…
-
Critical 9.8
Critical severity vulnerability that affects Haraka
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
-
Low 3.7
The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS c…
-
Unscored —
An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_…
-
Unscored —
An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcod…
-
Critical 9.8
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers…
KEV Apr 13, 2022 -
Critical 9.8
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that…
KEV May 24, 2022 -
Unscored —CVE-2019-7400 Public exploit
Rukovoditel before 2.4.1 allows XSS.
-
Unscored —
An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master…
-
Unscored —
An issue was discovered in 42Gears SureMDM before 2018-11-27, related to CORS settings. Cross-origin access is possible.
-
Unscored —
An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications…
-
Unscored —
An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a…
-
Unscored —CVE-2018-15657 Public exploit
An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter.
-
Unscored —
In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.
-
Unscored —
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access con…
-
Unscored —
In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.
-
Unscored —
In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders…
-
Unscored —
In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.
-
Unscored —
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access…
-
Unscored —
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access con…
-
High 8.8
DSA-2019-019: Dell Networking OS10 OS Command Injection Vulnerability
Dell OS10 versions prior to 10.4.2.1 contain a vulnerability caused by lack of proper input validation on the command-line interface (CLI).
-
Unscored —
A local file inclusion vulnerability exists in the web interface of Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W 1…
-
Unscored —
FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited …
-
Medium 4.0
IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pres…
-
High 7.1
IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML d…
-
Medium 5.3
IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0…
-
Medium 6.8
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memo…
-
Unscored —
An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV in…
-
Unscored —
Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/in…
-
Unscored —
OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) version v3.6-2 and earlier versions contains a SQL Inje…
-
Unscored —
phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that ca…
-
Unscored —
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection…
-
Unscored —
Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verificat…
-
Unscored —
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that ca…