Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
152 results · Clear filters · Feed
-
High 7.7
Data leakage when in an MDR pair by McAfee Network Security Manager 9.x
Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9.2 < 9.2.7.31 Update2 allows administrators to view configuration information in plain text format vi…
-
High 7.4
HashiCorp Consul vulnerable to Origin Validation Error
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.
-
High 7.5
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial …
-
High 7.8
Docker image code execution with Apache Mesos
A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A…
-
High 8.1
Improper Access Control in Elasticsearch
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fl…
-
High 7.5
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way…
-
High 7.5
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way S…
-
High 7.3
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A special…
-
High 7.3
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A…
-
High 7.5
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multipl…
-
High 7.0
An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modi…
-
High 7.8
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which coul…
-
High 7.4
Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when…
-
High 7.5
Cisco IP Phone 7800 Series and 8800 Series Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or e…
-
High 7.5
Cisco IP Phone 8800 Series Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service…
-
High 8.1
Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due …
-
High 8.1
Cisco IP Phone 8800 Series Path Traversal Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficie…
-
High 7.5
Cisco IP Phone 8800 Series File Upload Denial of Service Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition…
-
High 8.2
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registere…
-
High 7.5
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that …
-
High 7.5
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way p…
-
High 8.5
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware versi…
-
High 8.5
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware versi…
-
High 8.5
An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware versi…
-
High 8.2
An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.…
-
High 8.3
An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When parsing mDNS pac…
-
High 8.2
An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add a…
-
High 8.3
An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 700…
-
High 7.1
An exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to impro…
-
High 7.7
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.…
-
High 7.3
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an ex…
-
High 8.4
Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the p…
-
High 8.4
eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtua…
-
High 7.7
EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local atta…
-
High 8.4
eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtua…
-
High 8.4
Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain f…
-
High 8.4
eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error while in kiosk …
-
High 8.4
eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Fullsc…
-
High 8.4
Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the p…
-
High 8.4
EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full a…