Archive
2 April 2019
Vulnerabilities first published on this day (UTC), newest first.
39 results · Feed
-
Unscored —
A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to c…
-
Unscored —
SuiteCRM before 7.8.28, 7.9.x and 7.10.x before 7.10.15, and 7.11.x before 7.11.3 allows SQL Injection.
-
Unscored —
LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
-
Unscored —
Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessi…
-
Unscored —
Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially …
-
Unscored —
An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to …
-
High 7.5
CoAPthon DoS due to Exceptions
The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect C…
-
High 7.5
CoAPthon3 vulnerable to Deserialization of Untrusted Data
The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, example collect CoAP server and client) when they r…
-
Unscored —CVE-2019-10708 Public exploit
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
-
Unscored —
MKCMS V5.0 has SQL injection via the bplay.php play parameter.
-
Unscored —
The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, whi…
-
Unscored —
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitiz…
-
Unscored —
Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfigura…
-
Unscored —
A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unpriv…
-
Unscored —
A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unst…
-
Unscored —
A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext d…
-
Unscored —
qTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform redirect parameter.
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” di…
-
Medium 6.2
An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games, versio…
-
High 7.1
An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, ver…
-
Medium 6.2
An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version…
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install di…
-
Unscored —
VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) and Fusion (11.x before 11.0.3, 10.x before 10.1.6) updates…
-
Unscored —
VMware Workstation (14.x before 14.1.6) and Fusion (10.x before 10.1.6) contain an out-of-bounds write vulnerability in…
-
High 8.1
High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability ap…
-
Unscored —
An issue was discovered in TONGDA Office Anywhere 10.18.190121. There is a SQL Injection vulnerability via the general/…
-
Medium 6.5
IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, c…
-
Medium 5.1
IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM S…
-
High 8.8
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute…
-
Medium 4.0
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be rea…
-
Medium 5.9
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwor…
-
Medium 4.3
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which coul…
-
Low 3.5
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclo…
-
Medium 4.6
IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access …
-
Medium 4.3
IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specia…
-
High 7.7
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories …
-
Medium 4.3
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive inf…
-
Low 3.1
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful a…
-
High 7.1
IBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External Entity Injection (XXE) …