Archive
25 March 2019
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allo…
-
High 7.8
Docker image code execution with Apache Mesos
A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A…
-
Unscored —CVE-2019-7642 Public exploit
D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can r…
-
Critical 9.3
Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera …
-
Unscored —
A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to e…
-
Unscored —
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute una…
-
Unscored —
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to injec…
-
Unscored —
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to …
-
Unscored —
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all v…
-
Unscored —
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6,…
-
Unscored —
A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.ex…
-
Unscored —
The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), …
-
Critical 9.8
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from ver…
KEV Nov 3, 2021 -
Unscored —
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instanc…
-
Unscored —
Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain charac…
-
High 8.1
Improper Access Control in Elasticsearch
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fl…
-
Unscored —
A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If…
-
Unscored —
Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to …
-
High 7.5
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way…
-
High 7.5
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way S…
-
Medium 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parse…
-
Medium 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gr…
-
Medium 5.3
The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use t…
-
High 7.3
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A special…
-
High 7.3
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A…
-
Medium 6.5
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal co…
-
Unscored —CVE-2018-12653 Public exploit
A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0. An attacker can input malicious Ja…
-
Unscored —
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied i…
-
Unscored —
Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, …
-
Medium 5.9
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handli…
-
Unscored —
A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system director…
-
Unscored —
Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx cod…
-
Unscored —
ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attac…
-
Unscored —
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get t…
-
Unscored —
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get t…
-
Unscored —
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get t…
-
Unscored —
The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get t…
-
High 7.5
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multipl…
-
Unscored —
In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST in…
-
High 7.0
An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modi…