Skip to content
OpenAdvisories

Archive

22 April 2019

Vulnerabilities first published on this day (UTC), newest first.

← March 2019 2019 / April /22 May 2019 →
  1. 150
  2. 239
  3. 3202
  4. 499
  5. 522
  6. 63
  7. 77
  8. 881
  9. 9169
  10. 1054
  11. 1133
  12. 1225
  13. 132
  14. 141
  15. 1522
  16. 164
  17. 1772
  18. 1862
  19. 1929
  20. 2011
  21. 2126
  22. 2252
  23. 23188
  24. 2442
  25. 2569
  26. 2658
  27. 273
  28. 284
  29. 2926
  30. 3077
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2019-5427 Public exploit

    Billion laughs attack in c3p0

    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

    c3p0 com.mchange:c3p0 c3p0 Debian Ubuntu Maven
  • High 8.1
    CVE-2019-10248

    Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS

    Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be i…

    The Eclipse Foundation Eclipse Vorto org.eclipse.vorto:org.eclipse.vorto.core Maven
  • High 7.0
    CVE-2015-1340

    chmod race in doUidshiftIntoContainer

    LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's cho…

    Ubuntu LXD github.com/lxc/lxd Go
  • High 7.4
    CVE-2015-1341

    Apport privilege escalation through Python module imports

    Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.

    Ubuntu apport apport Ubuntu
  • High 7.1
    CVE-2016-1587

    The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controllin…

    Ubuntu snapweb
  • High 8.6
    CVE-2014-1426

    get_file_by_name does not check owner

    A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS versions prior to 1.9.2.

    Ubuntu MAAS
  • High 7.3
    CVE-2019-3899

    It was found that default configuration of Heketi does not require any authentication potentially exposing the manageme…

    The Heketi Project heketi