Archive
8 May 2019
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
Unscored —
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vaul…
-
Unscored —
Symantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue, which is a type of vuln…
-
Unscored —
Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potential…
-
Unscored —CVE-2019-11398 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitr…
-
Unscored —
Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.
-
High 7.5
Unsafe deserialization in SmtpTransport in CakePHP
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
-
High 7.5
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects p…
-
Unscored —
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted …
-
Critical 9.8
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vuln…
-
Medium 5.8CVE-2019-11507 Scanner template
In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on …
-
High 8.6CVE-2019-11508 EPSS 15%
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0…
-
Medium 6.5
An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Firework…
-
Unscored —
In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies t…
-
Unscored —
In wnm_parse_neighbor_report_elem of wnm_sta.c, there is a possible out-of-bounds read due to missing bounds check. Thi…
-
Unscored —
In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion. This could lead to remote in…
-
Unscored —
In heap of spaces.h, there is a possible out of bounds read due to improper input validation. This could lead to remote…
-
Unscored —
In tearDownClientInterface of WificondControl.java, there is a possible use after free due to improper locking. This co…
-
Unscored —
In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc, there is a possible memory corruption due to a use after f…
-
Unscored —
In UpdateLoadElement of ic.cc, there is a possible out-of-bounds write due to type confusion. This could lead to remote…
-
Unscored —
In CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to an integer overflow. …
-
Unscored —
In JSCallTyper of typer.cc, there is an out of bounds write due to an incorrect bounds check. This could lead to remote…
-
Unscored —
In MakeMP>G4VideoCodecSpecificData of APacketSource.cpp, there is a possible out-of-bounds write due to an incorrect bo…
-
Unscored —
In SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege due to an overlay att…
-
Critical 9.9
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthen…
KEV Nov 3, 2021 -
Unscored —
Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation.
-
Unscored —
The Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack. When the condition is trigg…
-
Unscored —CVE-2019-11564 Public exploit
A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or H…
-
High 7.8
Alkacon OpenCMS CSV Injection via New User module
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.
-
Low —
Alkacon OpenCMS XSS via New User module
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name),…
-
Unscored —
A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10. Authen…
-
Unscored —
Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. Remote adversaries can inj…
-
Unscored —
PrinterLogic Print Management Software updates and executes the code without origin and code verification
The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, perf…
-
Unscored —
PrinterLogic Print Management Software fails to validate the management portal SSL certificates
The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to sp…
-
Unscored —
PrinterLogic Print Management Software does not sanitize special characters
The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not sanitize special characters allowing for remote unauthorized changes to configuration files. An unauthenticated attacker may be able to remotely execute arbitrary cod…
-
Unscored —
An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race conditi…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web scrip…
-
Unscored —
MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
-
Unscored —
An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in ti…
-
Unscored —
An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XS…
-
Unscored —
A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be in…