Archive
27 March 2019
Vulnerabilities first published on this day (UTC), newest first.
75 results · Feed
-
High 7.4
phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.
-
Unscored —CVE-2018-19466 Public exploit
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master pass…
-
Medium 5.1
Solutions Business Manager (SBM) Denial of Service issue in version prior to 11.5
Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
-
Medium 6.1
Solutions Business Manager (SBM) Unauthenticated remote code execution issue in version prior to 11.5
Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
-
Unscored —
Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
-
Unscored —
Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.
-
Unscored —
Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occ…
-
Unscored —
A potential security vulnerability caused by incomplete obfuscation of application configuration information was discov…
-
Unscored —
A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified w…
-
Unscored —
HP Support Assistant before 8.7.50.3 allows an unauthorized person with local access to load arbitrary code.
-
Unscored —
Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocat…
-
Unscored —
A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process versi…
-
Unscored —
In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution …
-
Unscored —
Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Se…
-
Unscored —
An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote cont…
-
Critical 9.8
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalat…
-
High 7.5
Denial of Service Vulnerability in Action View
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.
-
Unscored —
Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 a…
-
High 7.5
Path Traversal in Action View
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
KEV Jul 7, 2025 -
Unscored —
PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restrict…
-
Unscored —
Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitra…
-
Unscored —
Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject a…
-
High 7.5
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attack…
-
Medium 5.8
A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information…
-
High 7.5
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenti…
-
High 7.7
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote a…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.G…
-
Medium 5.8
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with ba…
-
Unscored —
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
-
Unscored —
An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll…
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in Select2
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
-
Medium 6.1
Snipe-IT XSS Vulnerability
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
-
Unscored —
Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, d…
-
Medium 4.2
Ansible Path Traversal vulnerability
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
-
Medium 5.4CVE-2019-3847 Public exploit
Moodle XSS Vulnerability
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to t…