Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
1,196 results · Feed
-
Medium 5.4
A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict …
-
Medium 6.5
Moodle Blind SSRF Risk in /badges/mybackpack.php
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note tha…
-
Medium 6.4
A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function…
-
High 7.4
Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.
-
Unscored —
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Inf…
-
Unscored —
Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbi…
-
Unscored —
Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Sys…
-
Unscored —
Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.
-
Unscored —
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.
-
Unscored —
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in D…
-
Unscored —
Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Sys…
-
Unscored —
GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?…
-
Critical 9.8
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacke…
KEV Jan 10, 2022 -
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …
-
Unscored —
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for th…
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBit…
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bres…
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for th…
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx…
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nCom…
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bres…
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc …
-
Unscored —
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for th…
-
Unscored —
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" ac…
-
Unscored —
baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configu…
-
Unscored —
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users…
-
Medium 6.1
Moderate severity vulnerability that affects league/commonmark
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerabilit…
-
Medium 6.1
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_opti…
KEV Nov 3, 2021 -
Unscored —
The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows att…
-
Unscored —
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for…
-
Unscored —
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly hav…
-
Unscored —
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly hav…