Skip to content
OpenAdvisories

Archive

31 May 2019

Vulnerabilities first published on this day (UTC), newest first.

← April 2019 2019 / May /31 June 2019 →
  1. 117
  2. 226
  3. 359
  4. 4 
  5. 52
  6. 647
  7. 733
  8. 840
  9. 942
  10. 1033
  11. 11 
  12. 121
  13. 1380
  14. 1449
  15. 1572
  16. 16119
  17. 1793
  18. 18 
  19. 192
  20. 2030
  21. 2114
  22. 22166
  23. 23114
  24. 24146
  25. 25 
  26. 26 
  27. 274
  28. 2821
  29. 2951
  30. 3034
  31. 3142
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High —
    GHSA-8xqr-4cpm-wx7g

    Cross-Site Scripting in react-svg

    Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default. ## Recommendation Update to version 2.2.18 or later.

    react-svg npm
  • High —
    GHSA-j4mr-9xw3-c9jx

    Out-of-bounds Read in base64-url

    Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input. ## Recommendation Update to version 2.0.0 or later.

    base64-url npm
  • High 7.5
    GHSA-vmhw-fhj6-m3g5

    Path Traversal in angular-http-server

    Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal. ## Recommendation Update to version 1.4.4 or later.

    angular-http-server npm
  • High 7.3
    GHSA-xrmp-99wj-p6jc

    Prototype Pollution in deap

    Versions of `deap` before 1.0.1 are vulnerable to prototype pollution. ## Recommendation Update to version 1.0.1 or later.

    deap npm
  • High 7.5
    GHSA-xm28-fw2x-fqv2

    Denial of Service in foreman

    All versions of `foreman` are vulnerable to Regular Expression Denial of Service when requests to it are made with a specially crafted path. ## Recommendation Upgrade to version 3.0.1.

    foreman npm
  • High 8.8
    CVE-2019-9875 Exploited EPSS 25%

    Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to e…

    KEV Mar 26, 2025
  • High 8.1
    CVE-2019-10327

    XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin

    An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML …

    Jenkins Project Jenkins Pipeline Maven Integration Plugin org.jenkins-ci.plugins:pipeline-maven Web / CMS Maven
  • High 8.8
    CVE-2019-10329

    Plaintext password storage in Jenkins InfluxDB Plugin

    Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

    Jenkins Project Jenkins InfluxDB Plugin org.jenkins-ci.plugins:influxdb Web / CMS Maven
  • High 7.5
    CVE-2019-10330

    Improper handling of untrusted branches in Gitea Jenkins Plugin

    Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

    Jenkins Project Jenkins Gitea Plugin org.jenkins-ci.plugins:gitea Web / CMS Maven
  • High 7.5
    CVE-2019-12496

    Hybrid Group Gobot Improper Certificate Validation vulnerability

    An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.

    github.com/hybridgroup/gobot Go