Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
1,337 results · Feed
-
High —
Cross-Site Scripting in react-svg
Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default. ## Recommendation Update to version 2.2.18 or later.
-
High —
Out-of-bounds Read in base64-url
Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input. ## Recommendation Update to version 2.0.0 or later.
-
Low —
Cross-Site Scripting in public
All versions of `public` are vulnerable to stored cross-site scripting (XSS). ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
-
High 7.5
Path Traversal in angular-http-server
Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal. ## Recommendation Update to version 1.4.4 or later.
-
High 7.3
Prototype Pollution in deap
Versions of `deap` before 1.0.1 are vulnerable to prototype pollution. ## Recommendation Update to version 1.0.1 or later.
-
High 7.5
Denial of Service in foreman
All versions of `foreman` are vulnerable to Regular Expression Denial of Service when requests to it are made with a specially crafted path. ## Recommendation Upgrade to version 3.0.1.
-
Unscored —
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app)…
-
Unscored —
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow …
-
Unscored —
In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.
-
Unscored —
NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands…
-
Unscored —
The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. Aft…
-
Unscored —
The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attacke…
-
Unscored —
The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attacke…
-
Unscored —
It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an admin…
-
Unscored —
The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation …
-
Medium 5.4
PyDio Stored XSS Vulnerability
A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and af…
-
Unscored —
NVIDIA GeForce Experience versions prior to 3.19 contains a vulnerability in the Web Helper component, in which an atta…
-
Unscored —
An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libra…
-
Unscored —
The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the respon…
-
Unscored —CVE-2019-10038 Public exploit
Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable fil…
-
Unscored —
In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an aut…
-
Unscored —
The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalat…
-
High 8.8
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to e…
KEV Mar 26, 2025 -
Critical 9.8
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 a…
KEV Mar 26, 2025 -
Unscored —
Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission.
-
High 8.1
XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin
An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML …
-
Critical 9.9
Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin
Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
-
Medium 6.5
Jenkins Artifactory Plugin cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credential…
-
Medium 5.4
Jenkins Warnings NG Plugin Cross-site scripting vulnerability
A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages.
-
High 8.8
Plaintext password storage in Jenkins InfluxDB Plugin
Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 6.5
Cross-site request forgery vulnerability in Jenkins Artifactory Plugin
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a rel…
-
High 7.5
Improper handling of untrusted branches in Gitea Jenkins Plugin
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
-
Medium 6.5
Jenkins Artifactory Plugin missing permission check
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained t…
-
Medium 4.3
Jenkins Artifactory Plugin missing permission check
A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 4.3
Jenkins Warnings NG Plugin cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds.
-
Unscored —
An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path…
-
Unscored —
There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account…
-
Unscored —
The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because …
-
Unscored —
Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit c…
-
High 7.5
Hybrid Group Gobot Improper Certificate Validation vulnerability
An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.