Archive
7 May 2019
Vulnerabilities first published on this day (UTC), newest first.
33 results · Feed
-
Unscored —
The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 75…
-
Unscored —
NVIDIA Tegra TLK Widevine Trust Application contains a vulnerability in which missing the input parameter checking of v…
-
Unscored —
A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized use…
-
Unscored —
JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap…
-
Unscored —
JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qc…
-
Unscored —
cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page paramet…
-
Unscored —
An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the…
-
Unscored —CVE-2019-7541 Public exploit
Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.
-
Unscored —
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DB…
-
High 7.5CVE-2019-10742 Public exploit
Denial of Service in axios
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
-
Medium 4.3
IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which cou…
-
Medium 4.3
IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that cou…
-
Medium 4.0
IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that…
-
High 7.1
IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when pr…
-
Unscored —
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkd…
-
Unscored —
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkd…
-
Unscored —CVE-2018-20503 Public exploit
Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.
-
Unscored —
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive i…
-
Unscored —
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
-
Unscored —
ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipien…
-
High 7.5
The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attac…
-
High 8.8
The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF.
-
High 8.2
The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) o…
-
Medium 5.3
The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware imag…
-
Unscored —
Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.
-
Unscored —CVE-2019-10869 Public exploit
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uplo…
-
Unscored —
An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. A site administ…
-
Unscored —
A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticate…
-
Unscored —
An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection …
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc…
-
Unscored —
An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_…
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_fram…
-
Low 3.7
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack
Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically…