Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
1,196 results · Feed
-
Low 2.9
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, …
-
Low 2.9
Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visito…
-
Low 2.9
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, …
-
Medium 4.0
Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while i…
-
Unscored —
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
-
Unscored —
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attacke…
-
Unscored —
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to…
-
Unscored —
There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf…
-
Unscored —
There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf…
-
High 7.5
Matrix Synapse Predictable Secret Key
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
-
High 8.1
splunk-sdk does not properly verify untrusted TLS server certificates
Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks.
-
Unscored —
An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Passwords are stored using reversible encryption rather …
-
Unscored —CVE-2019-5722 Public exploit
An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Due to a lack of user input validation in parameter hand…
-
Unscored —
plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements.
-
Unscored —
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed…
-
Unscored —
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is d…
-
Medium 5.4
IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting. This v…
-
High 8.4
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared librar…
-
Unscored —
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Communit…
-
Unscored —
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edit…
-
Unscored —
SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user d…
-
Unscored —
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to…
-
High 7.5
Moodle SSRF Vulnerability
Moodle 3.5.x before 3.5.4 allows SSRF.
-
Unscored —
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product.
-
Unscored —
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.
-
Unscored —
An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the app…
-
Unscored —
The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Tic…
-
Unscored —
In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the…
-
Unscored —
The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a…
-
Unscored —
An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diag…
-
Unscored —
An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostic_tools_controller Di…
-
Unscored —
An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable…
-
Unscored —
An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drive…
-
Unscored —
An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 whic…
-
Unscored —
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary…
-
Unscored —
The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_t…
-
Unscored —
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
-
Unscored —
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
-
Unscored —
In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neg…