Skip to content
OpenAdvisories

Archive

March 2019

Vulnerabilities first published in this month (UTC), newest first.

← February 2019 2019 / March April 2019 →
  1. 111
  2. 22
  3. 32
  4. 411
  5. 578
  6. 6115
  7. 765
  8. 841
  9. 916
  10. 101
  11. 1138
  12. 1234
  13. 1331
  14. 1484
  15. 1539
  16. 1610
  17. 1795
  18. 1825
  19. 1949
  20. 2044
  21. 2153
  22. 2218
  23. 237
  24. 2426
  25. 2563
  26. 2660
  27. 2775
  28. 2860
  29. 2922
  30. 3017
  31. 314
All Critical High Medium Low Exploited only Public exploit

33 results · Clear filters · Feed

  • Critical 9.8
    CVE-2019-10648

    Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction

    Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.

    robocode robocode net.sf.robocode:robocode.host Debian Ubuntu Maven
  • Critical 9.8
    CVE-2019-1003040

    Sandbox bypass vulnerability in Jenkins Script Security Plugin

    A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  • Critical 9.8
    CVE-2019-1003041

    Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin

    A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

    Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  • Critical 9.8
    CVE-2019-5420 Public exploit EPSS 89%

    Use of Insufficiently Random Values in Railties Allows Remote Code Execution

    A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalat…

    rails https://github.com/rails/rails rails railties Debian RubyGems
  • Critical 9.8
    CVE-2019-10068 Exploited Public exploit Scanner template EPSS 95%

    An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x version…

    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2014-5401

    Hospira MedNet Code Injection

    Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet…

    Hospira MedNet
  • Critical 9.8
    CVE-2019-10061

    OS Command Injection in node-opencv

    utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.

    opencv node-opencv Debian npm
  • Critical 9.3
    CVE-2019-6538

    Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access Control

    The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera …

    Medtronic CareLink 2090 Programmer Virtuoso II ICD Maximo II ICD
  • Critical 9.8
    CVE-2019-3396 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from ver…

    Atlassian Confluence Server Web / CMS
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-7609 Exploited Public exploit Scanner template EPSS 95%

    Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacke…

    Elastic Kibana
    KEV Jan 10, 2022
  • Critical 9.1
    CVE-2019-9948 EPSS 12%

    urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypa…

    python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  • Critical 9.6
    CVE-2019-7539

    ipycache is vulnerable to Code Injection

    A code injection issue was discovered in ipycache through 2016-05-31.

    ipycache PyPI
  • Critical 9.8
    CVE-2019-7537

    Donfig Command Injection in collect_yaml method

    An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, resulting in command execution.

    donfig PyPI
  • Critical 9.8
    CVE-2019-7238 Exploited Public exploit Scanner template EPSS 77%

    Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.

    KEV Dec 10, 2021
  • Critical 9.0
    CVE-2018-3963

    An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When…

  • Critical 10.0
    CVE-2018-19276 Public exploit Scanner template EPSS 99%

    OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated us…

  • Critical 9.8
    CVE-2019-5413 Public exploit

    Code Injection in morgan

    An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

    morgan npm
  • Critical 9.8
    CVE-2019-1723

    Cisco Common Services Platform Collector Static Credential Vulnerability

    A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. T…

    Cisco Cisco Common Services Platform Collector Software Network devices
  • Critical 9.1
    CVE-2019-5919

    Nablarch Incomplete Cryptography

    An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.

    TIS Nablarch 5 com.nablarch.framework:nablarch-fw-web Maven
  • Critical 9.9
    CVE-2019-1003032

    Script security sandbox bypass in Jenkins Email Extension Plugin

    A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hu…

    Jenkins Project Jenkins Email Extension Plugin org.jenkins-ci.plugins:email-ext Web / CMS Maven
  • Critical 9.9
    CVE-2019-1003034

    Script security sandbox bypass in Jenkins Job DSL Plugin

    A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhi…

    Jenkins Project Jenkins Job DSL Plugin org.jenkins-ci.plugins:job-dsl Web / CMS Maven
  • Critical 9.9
    CVE-2019-1003029 Exploited Public exploit EPSS 74%

    Sandbox bypass in Script Security Plugin

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScr…

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
    KEV Apr 25, 2022
  • Critical 9.9
    CVE-2019-1003031

    Script security sandbox bypass in Matrix Project Plugin

    A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

    Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  • Critical 9.9
    CVE-2019-1003030 Exploited Public exploit Scanner template EPSS 97%

    Sandbox bypass in Jenkins Pipeline: Groovy Plugin

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the …

    Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
    KEV Mar 25, 2022
  • Critical 9.0
    CVE-2018-4054

    A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman…

    Talos Pixar Renderman
  • Critical 9.0
    CVE-2019-5015

    A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0's Install Helper he…

    Talos Pixar Renderman
  • Critical 9.1
    CVE-2019-3780

    Cloud Foundry Container Runtime Leaks IAAS Credentials

    Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to…

    Cloud Foundry Cloud Foundry Container Runtime (CFCR)
  • Critical 10.0
    CVE-2018-18815

    TIBCO JasperReports Server User Information Disclosure

    The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytic…

    TIBCO Software TIBCO JasperReports Server TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server - Community Edition
  • Critical 9.9
    CVE-2018-18809 Exploited Scanner template EPSS 79%

    TIBCO JasperReports Library Directory Traversal Vulnerability

    The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, …

    TIBCO Software TIBCO JasperReports Server TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server - Community Edition
    KEV Dec 29, 2022
  • Critical 9.8
    CVE-2018-16809

    Dolibarr SQL injection via the integer parameters qty and value_unit

    An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2019-0192 Public exploit Scanner template EPSS 78%

    Critical severity vulnerability that affects org.apache.solr:solr-core

    In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remot…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Ubuntu Maven
  • Critical 9.8
    CVE-2019-0187

    Unauthenticated Remote Code Execution in Apache JMeter

    Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This …

    Apache Software Foundation Apache JMeter org.apache.jmeter:ApacheJMeter jakarta-jmeter Debian Ubuntu Maven
  • Critical 9.8
    CVE-2019-0604 Exploited · Ransomware Public exploit EPSS 100%

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup…

    Microsoft Microsoft SharePoint Server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation
    KEV Nov 3, 2021