Archive
11 April 2019
Vulnerabilities first published on this day (UTC), newest first.
33 results · Feed
-
Unscored —
The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass …
-
Unscored —
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec…
-
Unscored —
The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0…
-
Unscored —
AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of s…
-
Unscored —
An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. The attacker must make a JSON-RPC…
-
Unscored —
A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript vi…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befo…
-
Critical 9.8
Critical severity vulnerability that affects Auth0-WCF-Service-JWT
Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepte…
-
Unscored —
SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user d…
-
Unscored —
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulat…
-
Unscored —
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider softwar…
-
Unscored —
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password …
-
Unscored —
Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a d…
-
Critical 9.8
Silverstripe Framework SQLi Vulnerability
All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.
-
Unscored —
The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, …
-
Unscored —
DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption. Data stored using this key can b…
-
Unscored —
diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote a…
-
High 7.6
A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neu…
-
Unscored —
On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is v…
-
Unscored —
NVIDIA Jetson TX2 contains a vulnerability in the kernel driver (on all versions prior to R28.3) where the ARM System M…
-
Unscored —
NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior …
-
Unscored —
UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even a…
-
Unscored —
A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.
-
Unscored —
A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.
-
Unscored —CVE-2018-19300 EPSS 74%
On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) be…
-
Unscored —
HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise…
-
Medium 6.1
It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an un…
-
High 8.0
A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agen…
-
Unscored —
Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an rem…
-
Unscored —
Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00…
-
Unscored —CVE-2019-3914 EPSS 30%
Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a re…
-
Unscored —
MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI.
-
Unscored —
FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 U…