Archive
30 May 2019
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Unscored —
An issue was discovered in GPAC 0.7.1. There is a heap-based buffer overflow in the function ReadGF_IPMPX_RemoveToolNot…
-
Unscored —
An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_…
-
Unscored —
An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c i…
-
Unscored —
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because …
-
High —
Cross-Site Scripting in bracket-template
All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template. ## Recommendation No fix is currently available for this vulnerability. It is our …
-
Unscored —
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
-
Unscored —
Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimb…
-
Unscored —
LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files an…
-
High 7.5
Improper Key Verification in ipns
Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid. ## Recommendation Update to version 0.1.3 or later.
-
Low 3.3
Insecure Credential Storage in web3
All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this …
-
Medium —
Cross-Site Scripting in bootbox
All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript. ## Recommendation Sanitize user input being passed…
-
High —
Directory Traversal in ltt.js
Affected versions of `ltt.js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private fil…
-
Unscored —
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
-
Unscored —
There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra W…
-
High 7.1
A researcher has disclosed several vulnerabilities against FortiClient for Windows version 6.0.5 and below, version 5.6…
-
Unscored —
A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthori…
-
Unscored —
A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attackers to execute unauthor…
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of the `Temp` directory in…
-
Unscored —
An unhandled exception vulnerability exists during Google Sign-In with Google API C++ Client before 2019-04-10. It pote…
-
Unscored —CVE-2019-8457 EPSS 45%
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when han…
-
Medium 5.9
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execut…
-
Medium 5.6
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution …
-
Medium 5.6
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative exec…
-
Medium 5.6
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing specu…
-
Unscored —CVE-2018-15131 Public exploit
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6,…
-
High 8.8
Privilege escalation vulnerability in Apache Hadoop
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
-
Unscored —
Web Port 1.19.1 allows XSS via the /log type parameter.
-
Unscored —CVE-2019-12460 Public exploit
Web Port 1.19.1 allows XSS via the /access/setup type parameter.
-
Unscored —
FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 20…
-
Unscored —
FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01.
-
Unscored —
FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01.
-
Unscored —
An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux k…
-
Unscored —
An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. The…
-
Unscored —
An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It…