Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
1,196 results · Feed
-
Medium 5.8
DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability
RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had se…
-
High 7.8
Information Exposure Vulnerability
RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed inf…
-
Unscored —
An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is…
-
Unscored —
An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4…
-
Unscored —
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 1 by…
-
High 7.5
Cisco Small Business SPA514G IP Phones SIP Denial of Service Vulnerability
A vulnerability in the implementation of Session Initiation Protocol (SIP) processing in Cisco Small Business SPA514G IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of servic…
-
Critical 9.8
Cisco Common Services Platform Collector Static Credential Vulnerability
A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. T…
-
Unscored —
In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operation…
-
Unscored —
An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (…
-
Unscored —
In tinysvcmdns through 2018-01-16, a maliciously crafted mDNS (Multicast DNS) packet triggers an infinite loop while pa…
-
Unscored —
In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source…
-
Unscored —
gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overfl…
-
Unscored —
Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change …
-
Unscored —
In libwebm before 2019-03-08, a NULL pointer dereference caused by the functions OutputCluster and OutputTracks in webm…
-
Unscored —
gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Cha…
-
Unscored —
An issue was discovered in Microvirt MEmu 6.0.6. The MemuService.exe service binary is vulnerable to local privilege es…
-
Unscored —
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, …
-
Medium 6.5
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …
-
Medium 6.5
OpenStack Neutron's unsupported dport option prevents applying security groups
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that …
-
Unscored —
jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
-
Unscored —
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
-
Medium 6.1
Cross-Site Scripting in editor.md
Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
-
Unscored —
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted…
-
Unscored —
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode…
-
Unscored —
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted fro…
-
Unscored —
SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or …
-
Unscored —
Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) perfo…
-
Unscored —
SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, …
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently va…
-
Medium 5.3
Data Leakage Vulnerability in McAfee Database Security web interface
Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen.
-
Unscored —CVE-2019-9729 Public exploit
In Shanda MapleStory Online V160, the SdoKeyCrypt.sys driver allows privilege escalation to NT AUTHORITY\SYSTEM because…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the au…
-
Unscored —
Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified ve…
-
Unscored —
Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Pr…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the…
-
Unscored —
Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attack…
-
Unscored —CVE-2019-5917 EPSS 21%
azure-umqtt-c (available through GitHub prior to 2017 October 6) allows remote attackers to cause a denial of service v…
-
Unscored —
Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an uns…
-
Unscored —
Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Tro…