Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
123 results · Clear filters · Feed
-
Unscored —
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
-
Unscored —CVE-2019-10664 Public exploit
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
-
Unscored —
Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0…
-
Unscored —CVE-2019-10652 Public exploit
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .…
-
High 7.5
Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
-
High 7.5CVE-2019-0225 Public exploit
Improper Limitation of a Pathname ('Path Traversal') in org.apache.jspwiki:jspwiki-war
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
-
Unscored —
Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.
-
Unscored —
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker ca…
-
Unscored —
The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated …
-
Medium 5.3CVE-2019-1759 Public exploit
Cisco IOS XE Software Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability
A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the Gigabit Ethernet Management interface.…
-
High 7.4CVE-2019-1749 Public exploit
Cisco Aggregation Services Router 900 Route Switch Processor 3 OSPFv2 Denial of Service Vulnerability
A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router (ASR) 900 Route Switch Processor 3 (RSP3) could allow an unauthenticated, adjacent attacker to trigger a reload of an affected device, resulting i…
-
Unscored —CVE-2018-19466 Public exploit
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master pass…
-
Critical 9.8
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalat…
-
High 7.5
Path Traversal in Action View
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
KEV Jul 7, 2025 -
Medium 5.4CVE-2019-3847 Public exploit
Moodle XSS Vulnerability
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to t…
-
Critical 9.8
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x version…
KEV Mar 25, 2022 -
Unscored —
An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php a…
-
Unscored —
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achiev…
-
Unscored —CVE-2019-7646 Public exploit
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Packag…
-
Unscored —CVE-2019-7711 Public exploit
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented…
-
Unscored —CVE-2019-7642 Public exploit
D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can r…
-
Critical 9.8
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from ver…
KEV Nov 3, 2021 -
Unscored —CVE-2018-12653 Public exploit
A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0. An attacker can input malicious Ja…
-
High 7.8
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which coul…
-
Critical 9.8
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacke…
KEV Jan 10, 2022 -
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …
-
Medium 6.1
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_opti…
KEV Nov 3, 2021 -
Unscored —
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relat…
-
Unscored —CVE-2018-20165 Public exploit
Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web scrip…
-
Unscored —
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote at…
-
Medium 5.3
CoreFTP Directory Traversal
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned informatio…
-
Unscored —CVE-2019-8997 Public exploit
An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions ea…
-
Critical 9.8
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
KEV Dec 10, 2021 -
Unscored —CVE-2019-9896 Public exploit
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file…
-
Unscored —CVE-2019-7441 Public exploit
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter…
-
Unscored —CVE-2019-7440 Public exploit
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_…
-
Unscored —CVE-2019-7439 Public exploit
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.
-
Unscored —CVE-2019-7438 Public exploit
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.
-
Unscored —
An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3…
-
Unscored —CVE-2019-6282 Public exploit
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpa…