Skip to content
OpenAdvisories

Archive

26 March 2019

Vulnerabilities first published on this day (UTC), newest first.

← February 2019 2019 / March /26 April 2019 →
  1. 111
  2. 22
  3. 32
  4. 411
  5. 578
  6. 6115
  7. 765
  8. 841
  9. 916
  10. 101
  11. 1138
  12. 1234
  13. 1331
  14. 1484
  15. 1539
  16. 1610
  17. 1795
  18. 1825
  19. 1949
  20. 2044
  21. 2153
  22. 2218
  23. 237
  24. 2426
  25. 2563
  26. 2660
  27. 2775
  28. 2860
  29. 2922
  30. 3017
  31. 314
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 5.4
    CVE-2019-6341 EPSS 12%

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

    In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerabi…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
  • Medium 4.0
    CVE-2019-3830

    Ceilometer Prints Sensitive Configuration Data to Log

    A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

    [UNKNOWN] openstack-ceilometer ceilometer ceilometer Debian PyPI
  • Medium 5.0
    CVE-2019-8989

    TIBCO Spotfire Data Science Spoofing Vulnerability

    The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to look like a different user in the affected system. Affec…

    TIBCO Software TIBCO Data Science for AWS TIBCO Spotfire Data Science
  • Medium 6.5
    CVE-2019-8988

    TIBCO Spotfire Data Science Privilege Escalation Vulnerability

    The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulnerability that theoretically allows a user to escalate their privileges on the affected syste…

    TIBCO Software TIBCO Spotfire Data Science TIBCO Data Science for AWS
  • Medium 6.1
    CVE-2019-3826

    A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could ex…

    [UNKNOWN] prometheus prometheus prometheus Debian Ubuntu
  • Medium 6.5
    CVE-2019-6540

    Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information

    The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera …

    Medtronic CareLink 2090 Programmer CareLink Monitor Virtuoso ICD
  • Medium 4.3
    CVE-2019-3852

    Moodle context freezing

    A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing into account when checking user capabilities

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2019-3851

    Moodle Secure layout contained an insecure link in Boost theme

    A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page.

    [UNKNOWN] moodle moodle/moodle Web / CMS Packagist
  • Medium 4.3
    CVE-2019-3850

    Moodle Stored HTML in assignment submission comments allowed links to be opened directly

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no…

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.3
    CVE-2019-3849

    Moodle Users could elevate their role when accessing the LTI tool on a provider site

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.

    [UNKNOWN] moodle moodle/moodle Web / CMS Packagist
  • Medium 5.5
    CVE-2018-16856

    Openstack Octavia allows Insertion of Sensitive Information into Log File

    In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private key…

    [UNKNOWN] openstack-octavia octavia octavia Ubuntu PyPI
  • Medium 6.5
    CVE-2019-3597

    Authentication bypass in McAfee Network Security Manager 9.x

    Authentication Bypass vulnerability in McAfee Network Security Manager (NSM) 9.1 < 9.1.7.75.2 and 9.2 < 9.2.7.31 (9.2 Update 2) allows unauthenticated users to gain administrator rights via incorrect handling of expired GUI sessions.

    McAfee McAfee Network Security Manager (NSM)
  • Medium 4.3
    CVE-2019-3848

    Moodle Logged in users could view all calendar events

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar event…

    [UNKNOWN] moodle moodle/moodle Web / CMS Packagist