Archive
12 March 2019
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Unscored —
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted…
-
Unscored —
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode…
-
Unscored —
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted fro…
-
Unscored —
SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or …
-
Unscored —
Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) perfo…
-
Unscored —
SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, …
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently va…
-
Medium 5.3
Data Leakage Vulnerability in McAfee Database Security web interface
Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen.
-
Unscored —CVE-2019-9729 Public exploit
In Shanda MapleStory Online V160, the SdoKeyCrypt.sys driver allows privilege escalation to NT AUTHORITY\SYSTEM because…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the au…
-
Unscored —
Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified ve…
-
Unscored —
Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Pr…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the…
-
Unscored —
Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attack…
-
Unscored —CVE-2019-5917 EPSS 21%
azure-umqtt-c (available through GitHub prior to 2017 October 6) allows remote attackers to cause a denial of service v…
-
Unscored —
Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an uns…
-
Unscored —
Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Tro…
-
Critical 9.1
Nablarch Incomplete Cryptography
An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.
-
Unscored —
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To ex…
-
Unscored —
The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field u…
-
Unscored —
Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerabil…
-
Unscored —
An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS.
-
Unscored —
An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access.
-
Unscored —
An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS.
-
Unscored —
An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS.
-
Unscored —
On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or…
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Int…
-
Unscored —
In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video …
-
Unscored —
A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video f…
-
High 8.1
Webargs mishandles concurrent JSON parsing
An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for c…
-
Unscored —
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a la…
-
Unscored —
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and dae…
-
Unscored —
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) vi…