Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
1,196 results · Feed
-
Unscored —
OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protect…
-
Unscored —
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
-
Unscored —
treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions.
-
Unscored —CVE-2019-10664 Public exploit
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
-
Unscored —CVE-2019-10663 EPSS 28%
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the …
-
Unscored —CVE-2019-10662 EPSS 44%
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metac…
-
Unscored —
On Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password.
-
Unscored —
Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell m…
-
Unscored —
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitr…
-
Unscored —
Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metach…
-
Unscored —
Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover pa…
-
Unscored —
Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metach…
-
Unscored —
Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0…
-
Unscored —
The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote a…
-
Unscored —CVE-2019-10652 Public exploit
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .…
-
Unscored —
In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, wh…
-
Unscored —
In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an a…
-
Critical 9.8
Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
-
Unscored —
ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/co…
-
Unscored —
Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allo…
-
Unscored —
An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account.
-
Unscored —
An elevation of privilege vulnerability exists in the Call Dispatcher in Provisio SiteKiosk before 9.7.4905.
-
Unscored —
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaS…
-
Unscored —
TP-Link TL-WR840N devices allow remote attackers to cause a denial of service (networking outage) via fragmented packet…
-
Unscored —
The L2CAP signaling channel implementation and SDP server implementation in OpenSynergy Blue SDK 3.2 through 6.0 allow …
-
Medium 5.8CVE-2019-9922 EPSS 10%
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access …
-
High 7.7
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to read information that…
-
High 7.7
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to perform an action wit…
-
Medium 5.4
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a w…
-
High 8.5
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and querie…
-
Unscored —
The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an ident…
-
Unscored —
The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before versio…
-
Unscored —
The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from…
-
Unscored —
The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allow…
-
Unscored —
The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows r…
-
Unscored —
The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with ad…
-
Unscored —
PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actio…
-
Unscored —
PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value i…
-
Unscored —
Norton Core prior to v278 may be susceptible to an arbitrary code execution issue, which is a type of vulnerability tha…
-
Unscored —
Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a righ…