Archive
26 April 2019
Vulnerabilities first published on this day (UTC), newest first.
58 results · Feed
-
Unscored —
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php actio…
-
Unscored —
The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validat…
-
Medium 4.5CVE-2019-3843 Public exploit
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be all…
-
Medium 4.5CVE-2019-3844 Public exploit
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of…
-
Unscored —
A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using …
-
Unscored —
Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web sc…
-
Unscored —
ProjectSend before r1070 writes user passwords to the server logs.
-
Unscored —
XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the a…
-
Unscored —
Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in g…
-
Unscored —
Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attacke…
-
Unscored —
Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboa…
-
Unscored —
Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attac…
-
Unscored —
An authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively intercept user-to-devic…
-
Unscored —
The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers fro…
-
Unscored —
An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automa…
-
High 8.6
WS-MAN Authentication Bypass Vulnerability
Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-…
-
High 8.6
Web Interface Authentication Bypass Vulnerability
Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending …
-
High 8.1
Buffer Overflow Vulnerability
Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may pote…
-
High 7.5
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Support…
KEV Jan 10, 2022 -
Unscored —
A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed …
-
Unscored —
The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the l…
-
Unscored —
A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can b…
-
Unscored —
Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImag…
-
Unscored —
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digi…
-
Unscored —
A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the soun…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed e…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thund…
-
Unscored —
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects …
-
Unscored —
A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, …
-
Unscored —
Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local applicatio…
-
Unscored —
Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be…
-
Unscored —
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre miti…
-
Unscored —
On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This…
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…
-
Unscored —
If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to ren…
-
Unscored —
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocati…
-
Unscored —
The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), …
-
Unscored —
In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on…
-
Unscored —
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by maliciou…
-
Unscored —
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driv…