Archive
17 March 2019
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Unscored —
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple …
-
Unscored —
The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB …
-
Unscored —
internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, v…
-
Unscored —
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple …
-
High 8.1CVE-2019-5414 Public exploit
Command Injection in kill-port
If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.
-
Unscored —
XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, a…
-
Unscored —
XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/h…
-
Critical 9.8CVE-2019-5413 Public exploit
Code Injection in morgan
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
-
Unscored —
SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL…
-
High 7.5
Path Traversal in localhost-now
A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remote server.
-
Unscored —CVE-2018-18798 Public exploit
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.p…
-
Unscored —
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
-
High 7.5
Path Traversal in serve
A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to.
-
High 7.5
Directory Traversal in serve
A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server.
-
Unscored —
A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 881…
-
Medium 6.1
Microweber XSS Vulnerability
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
-
Unscored —CVE-2018-18762 Public exploit
SaltOS 3.1 r8126 contains a database download vulnerability.
-
Unscored —
Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.…
-
High 7.5
Improper Certificate Validation in chloride
Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated…
-
Unscored —
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, an…
-
Unscored —
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/sy…
-
Unscored —CVE-2018-18435 Public exploit
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting an…
-
Unscored —
Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel.
-
Unscored —
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, an…
-
Unscored —
An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-2018…
-
Unscored —CVE-2018-17997 Public exploit
LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
-
Unscored —
OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)
-
Unscored —
HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form.
-
Unscored —CVE-2018-17996 Public exploit
LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete…
-
Unscored —
OX App Suite 7.8.4 and earlier allows SSRF.
-
Unscored —
The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
-
Unscored —
An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF…
-
Unscored —
An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOT…
-
Unscored —
VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter.
-
Unscored —
libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a cr…
-
Unscored —
In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However,…
-
Unscored —
An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device …
-
Unscored —
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
-
Unscored —
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtai…
-
High 7.5
jackson-databind Deserialization of Untrusted Data vulnerability
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the class…