Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
1,196 results · Feed
-
Unscored —
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly hav…
-
Unscored —
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly hav…
-
Unscored —
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have u…
-
Unscored —
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have u…
-
Unscored —
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have u…
-
Unscored —
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have u…
-
Unscored —
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relat…
-
Unscored —
In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which a…
-
Unscored —
Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations"…
-
Unscored —
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
-
Critical 9.1CVE-2019-9948 EPSS 12%
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypa…
-
Medium 5.4
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …
-
Unscored —
SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to veri…
-
Low 3.7
Twig Sandbox Information Disclosure
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
-
High 7.5
Cisco IP Phone 7800 Series and 8800 Series Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or e…
-
High 7.5
Cisco IP Phone 8800 Series Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service…
-
High 8.1
Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due …
-
High 8.1
Cisco IP Phone 8800 Series Path Traversal Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficie…
-
High 7.5
Cisco IP Phone 8800 Series File Upload Denial of Service Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition…
-
Unscored —CVE-2018-20165 Public exploit
Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web scrip…
-
Unscored —
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote at…
-
Medium 6.3
IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake I…
-
High 8.2
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registere…
-
Medium 5.3
CoreFTP Directory Traversal
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned informatio…
-
Unscored —
The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open…
-
Unscored —
The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public "open…
-
Unscored —
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL …
-
Unscored —
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5H…
-
High 7.5
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that …
-
Unscored —
Caret before 2019-02-22 allows Remote Code Execution.
-
Unscored —
S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.
-
Unscored —
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execu…
-
Unscored —CVE-2019-9915 Scanner template
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.
-
Unscored —
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.
-
Unscored —
The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term …
-
Unscored —CVE-2019-9912 Scanner template
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.
-
Unscored —
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssna…
-
Unscored —
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.
-
Unscored —
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.
-
Unscored —
The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.