Archive
25 March 2019
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Inf…
-
High 7.8
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which coul…
-
Medium 5.4
A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict …
-
Medium 6.5
Moodle Blind SSRF Risk in /badges/mybackpack.php
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note tha…
-
Medium 6.4
A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function…
-
High 7.4
Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.
-
Unscored —
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Inf…
-
Unscored —
Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbi…
-
Unscored —
Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Sys…
-
Unscored —
Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.
-
Unscored —
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in D…
-
Unscored —
Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Sys…
-
Unscored —
GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?…
-
Critical 9.8
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacke…
KEV Jan 10, 2022 -
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …