Archive
10 May 2019
Vulnerabilities first published on this day (UTC), newest first.
33 results · Feed
-
Unscored —
The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to o…
-
Medium 5.3
Unauthorized File Access in harp
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge.
-
Medium 5.3
Unauthorized File Access in harp
Path traversal using symlink in npm harp module versions <= 0.29.0.
-
Unscored —
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over …
-
Unscored —
NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer…
-
Unscored —
NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly …
-
Unscored —
NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer…
-
Unscored —
An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It…
-
Unscored —
Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow.
-
Unscored —
Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an…
-
Unscored —
openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET metho…
-
Unscored —
OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security head…
-
Unscored —
OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which …
-
High 8.1
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially …
-
Unscored —
A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.…
-
Unscored —
A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version …
-
Unscored —
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web …
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An a…
-
Unscored —
A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to exec…
-
Unscored —
If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory content…
-
Unscored —
The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to …
-
High 7.5
Path Traversal in DKPro Core
core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.
-
Unscored —
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.
-
Unscored —
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
-
Medium 5.4
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This…
-
Medium 4.3
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request for…
-
Medium 5.3
IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration …
-
Unscored —
OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).
-
Unscored —
An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200 cameras. An attacker on the sam…
-
Unscored —
Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The c…
-
Unscored —
A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9…
-
Critical 10.0CVE-2019-1867 EPSS 30%
Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability
A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit thi…
-
Unscored —
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.