Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
1,196 results · Feed
-
Unscored —
Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 a…
-
High 7.5
Path Traversal in Action View
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
KEV Jul 7, 2025 -
Unscored —
PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restrict…
-
Unscored —
Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitra…
-
Unscored —
Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject a…
-
High 7.5
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attack…
-
Medium 5.8
A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information…
-
High 7.5
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenti…
-
High 7.7
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote a…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.G…
-
Medium 5.8
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with ba…
-
Unscored —
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
-
Unscored —
An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll…
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in Select2
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
-
Medium 6.1
Snipe-IT XSS Vulnerability
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
-
Unscored —
Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, d…
-
Medium 4.2
Ansible Path Traversal vulnerability
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
-
Medium 5.4CVE-2019-3847 Public exploit
Moodle XSS Vulnerability
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to t…
-
Unscored —
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML…
-
Unscored —
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences …
-
Unscored —
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" actio…
-
Unscored —
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via …
-
Unscored —
PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
-
Unscored —
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML…
-
Unscored —
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML…
-
Unscored —
The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into …
-
Unscored —
An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. Command injection can occur in…
-
Unscored —
An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG …
-
Unscored —
FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d63 …
-
Unscored —
FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d7d …
-
Unscored —
FastStone Image Viewer 6.5 has an Exception Handler Chain Corrupted issue starting at image00400000+0x00000000003ef68a …
-
Unscored —
FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000001cb509 via a crafted image fi…
-
Unscored —
FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000000e1237 via a crafted image fi…
-
Unscored —
A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior…
-
Medium 5.4CVE-2019-6341 EPSS 12%
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerabi…
-
Medium 4.0
Ceilometer Prints Sensitive Configuration Data to Log
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
-
Medium 5.0
TIBCO Spotfire Data Science Spoofing Vulnerability
The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to look like a different user in the affected system. Affec…
-
Medium 6.5
TIBCO Spotfire Data Science Privilege Escalation Vulnerability
The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulnerability that theoretically allows a user to escalate their privileges on the affected syste…
-
High 7.6
TIBCO Spotfire Data Science Vulnerable to Persistent Cross-Site Scripting
The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site scripting vulnerability that theoretically allows an authenticated user to gain access to all the capabiliti…
-
Medium 6.1
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could ex…