Archive
16 May 2019
Vulnerabilities first published on this day (UTC), newest first.
119 results · Feed
-
Medium 5.4CVE-2019-10909 Public exploit
Symfony Cross-site Scripting (XSS) vulnerability
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
-
Critical 9.8
Symfony Service IDs Allow Injection
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
-
High 7.5
Improper authentication in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabl…
-
High 7.1
Deserialization of untrusted data in Symfony
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has …
-
Critical 9.8
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injectio…
-
High 7.3
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6…
-
Unscored —
A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka …
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Unscored —
An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not pro…
-
Medium 5.5
NuGet Package Manager Tampering Vulnerability
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnerability'.
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
-
Unscored —
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly s…
-
Unscored —
A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feat…
-
Unscored —
An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows…
-
Unscored —
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its …
-
Unscored —
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially …
-
Unscored —
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially …
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2…
-
Unscored —
An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppCon…
-
Unscored —CVE-2019-0947 EPSS 14%
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles ob…
-
Unscored —CVE-2019-0940 EPSS 23%
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsof…
-
Unscored —CVE-2019-0945 EPSS 14%
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles ob…
-
Unscored —CVE-2019-0946 EPSS 14%
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles ob…
-
Unscored —
An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially …
-
Unscored —
An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it imprope…
-
Unscored —CVE-2019-0953 EPSS 13%
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in mem…
-
Unscored —
A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web req…
-
Unscored —
A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filt…
-
Unscored —
A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web req…
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2…
-
Unscored —
An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbo…
-
Unscored —
A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web req…
-
Unscored —
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft bro…
-
Unscored —CVE-2019-0902 EPSS 19%
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory,…
-
Unscored —
An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Window…
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0914, CVE-2…
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2…
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2…