Archive
13 May 2019
Vulnerabilities first published on this day (UTC), newest first.
80 results · Feed
-
Unscored —
An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file …
-
Medium 6.6
The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an informat…
-
Unscored —
Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wpp…
-
Unscored —
In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-…
-
Unscored —
In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 …
-
Unscored —
In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabiliti…
-
Unscored —
D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1…
-
Unscored —CVE-2018-19986 EPSS 42%
In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link D…
-
Unscored —
An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier…
-
Medium 6.1
Cross-Site Scripting in simditor
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.
-
Medium 6.1
Cross-site Scripting in remarkable
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
-
Unscored —
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admi…
-
Unscored —
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to in…
-
Unscored —
Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard drop…
-
Unscored —
panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
-
Unscored —
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
-
Unscored —
index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
-
Unscored —
Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
-
Unscored —
An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation o…
-
Unscored —
Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custo…
-
Unscored —
Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript v…
-
Unscored —
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via direc…
-
Unscored —
Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to ste…
-
Unscored —
Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interfac…
-
Unscored —CVE-2018-12300 Scanner template
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in t…
-
Unscored —
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploa…
-
Unscored —
Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's c…
-
Unscored —
Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via U…
-
Unscored —
Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows atta…
-
Unscored —
SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL co…
-
Unscored —
System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system c…
-
Unscored —
Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrar…
-
Unscored —
Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands vi…
-
Unscored —
Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attacker…
-
Unscored —
Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript v…
-
Unscored —
On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST reques…
-
High 7.5
Regular Expression Denial of Service in remarkable
lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
-
Unscored —
Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, wh…
-
Unscored —
ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.
-
Unscored —CVE-2019-11886 Scanner template
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress al…