Archive
20 May 2019
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote auth…
-
Medium 6.1CVE-2019-10078 Public exploit
Cross-site Scriptin in JSPWiki
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were …
-
Medium 6.1CVE-2019-10077 Public exploit
Cross-site Scripting in JSPWiki
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
-
Medium 6.1CVE-2019-10076 Public exploit
Cross-Site Scripting in JSPWiki
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
-
Unscored —
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-c…
-
Unscored —
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.
-
Unscored —
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL in…
-
Unscored —CVE-2019-8352 Public exploit
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials se…
-
Low 3.3
IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a loca…
-
Medium 6.5
IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements …
-
Medium 5.3
IBM Storwize V7000 Unified (2073) 1.6 configuration may allow an attacker to reveal the server version in default insta…
-
Medium 5.4
IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the fun…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to dis…
-
Unscored —
In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in …
-
Unscored —
When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, lea…
-
Unscored —
When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due…
-
Unscored —
When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcp…
-
Unscored —
In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the cli…
-
Unscored —
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.
-
Unscored —
njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.
-
Unscored —
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.
-
Unscored —
An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data…
-
Unscored —
In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header.