Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
123 results · Clear filters · Feed
-
Unscored —CVE-2019-6279 Public exploit
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulner…
-
Unscored —
Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote atta…
-
Unscored —
Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote att…
-
Unscored —
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
-
Unscored —
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attacke…
-
Unscored —
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to…
-
Unscored —CVE-2019-5722 Public exploit
An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Due to a lack of user input validation in parameter hand…
-
Unscored —
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary…
-
Unscored —
The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_t…
-
Unscored —
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
-
Unscored —
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
-
Unscored —
www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitr…
-
Unscored —CVE-2018-19487 Public exploit
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_prof…
-
Critical 10.0
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated us…
-
Unscored —CVE-2018-14575 Public exploit
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (C…
-
Unscored —
Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deseriali…
-
Unscored —
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authe…
-
Unscored —
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the d…
-
Unscored —
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input direc…
-
Unscored —CVE-2018-20162 Public exploit
Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super'…
-
High 8.1CVE-2019-5414 Public exploit
Command Injection in kill-port
If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.
-
Critical 9.8CVE-2019-5413 Public exploit
Code Injection in morgan
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
-
Unscored —CVE-2018-18798 Public exploit
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.p…
-
Unscored —
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
-
Unscored —CVE-2018-18762 Public exploit
SaltOS 3.1 r8126 contains a database download vulnerability.
-
Unscored —
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, an…
-
Unscored —CVE-2018-18435 Public exploit
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting an…
-
Unscored —CVE-2018-17997 Public exploit
LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
-
Unscored —CVE-2018-17996 Public exploit
LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete…
-
Unscored —
An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOT…
-
Unscored —
Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server…
-
Unscored —
AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
-
Unscored —CVE-2019-6716 Public exploit
An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 th…
-
Unscored —
An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in P…
-
Unscored —
SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is…
-
Unscored —
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.
-
High 7.5CVE-2019-6690 Public exploit
Improper Input Validation python-gnupg
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Impr…
-
Unscored —CVE-2019-9834 Public exploit
The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an impo…
-
Unscored —
The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many …
-
Unscored —CVE-2019-9832 Public exploit
The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that …