Skip to content
OpenAdvisories

Archive

17 March 2019

Vulnerabilities first published on this day (UTC), newest first.

← February 2019 2019 / March /17 April 2019 →
  1. 111
  2. 22
  3. 32
  4. 411
  5. 578
  6. 6115
  7. 765
  8. 841
  9. 916
  10. 101
  11. 1138
  12. 1234
  13. 1331
  14. 1484
  15. 1539
  16. 1610
  17. 1795
  18. 1825
  19. 1949
  20. 2044
  21. 2153
  22. 2218
  23. 237
  24. 2426
  25. 2563
  26. 2660
  27. 2775
  28. 2860
  29. 2922
  30. 3017
  31. 314
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.1
    CVE-2019-5414 Public exploit

    Command Injection in kill-port

    If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.

    kill-port npm
  • High 7.5
    CVE-2019-5416

    Path Traversal in localhost-now

    A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remote server.

    localhost-now npm
  • High 7.5
    CVE-2019-5415

    Path Traversal in serve

    A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to.

    serve npm
  • High 7.5
    CVE-2019-5417

    Directory Traversal in serve

    A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server.

    serve npm
  • High 7.5
    CVE-2018-6517

    Improper Certificate Validation in chloride

    Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated…

    Puppet Chloride chloride RubyGems
  • High 7.5
    CVE-2018-12022

    jackson-databind Deserialization of Untrusted Data vulnerability

    An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the class…

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • High 7.5
    CVE-2018-12023

    Deserialization of Untrusted Data

    An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP…

    jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  • High 7.5
    CVE-2019-6690 Public exploit

    Improper Input Validation python-gnupg

    python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Impr…

    python-gnupg python-gnupg python-gnupg Debian Ubuntu PyPI