Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
111 results · Clear filters · Feed
-
Unscored —
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app)…
-
Unscored —
NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands…
-
Unscored —CVE-2019-10038 Public exploit
Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable fil…
-
Unscored —
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because …
-
Unscored —CVE-2018-15131 Public exploit
An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6,…
-
Unscored —
Web Port 1.19.1 allows XSS via the /log type parameter.
-
Unscored —CVE-2019-12460 Public exploit
Web Port 1.19.1 allows XSS via the /access/setup type parameter.
-
Critical 9.8
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (X…
KEV Jan 10, 2022 -
Unscored —
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description fie…
-
Unscored —
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulne…
-
Medium 6.1
Cross-site scripting in Apache Tomcat
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and…
-
Unscored —CVE-2019-12372 Public exploit
Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
-
Unscored —CVE-2019-7069 Public exploit
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier ve…
-
Unscored —CVE-2019-10685 Public exploit
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Heidelberg Prinect Archiver v2013 release 1.0.
-
Unscored —CVE-2019-10847 Public exploit
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
-
Unscored —CVE-2019-10848 Public exploit
Computrols CBAS 18.0.0 allows Username Enumeration.
-
Unscored —CVE-2019-12195 Public exploit
TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking…
-
Unscored —
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as…
-
Unscored —CVE-2019-5796 Public exploit
Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially expl…
-
Unscored —CVE-2019-10846 Public exploit
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and pass…
-
Unscored —CVE-2019-5789 Public exploit
An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed…
-
Unscored —CVE-2019-5788 Public exploit
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 all…
-
Unscored —CVE-2019-10849 Public exploit
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
-
Unscored —CVE-2019-10866 Public exploit
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels…
-
Unscored —CVE-2019-12272 Public exploit
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_s…
-
Unscored —CVE-2018-7844 Public exploit
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum…
-
Unscored —CVE-2018-7854 Public exploit
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, a…
-
High 7.5CVE-2018-7852 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —CVE-2018-7845 Public exploit
A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Mo…
-
Unscored —CVE-2018-7848 Public exploit
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum…
-
Unscored —CVE-2018-7843 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —CVE-2018-7849 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum a…
-
Unscored —
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon…
-
Unscored —
A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 w…
-
Critical 9.8
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted cod…
KEV Apr 15, 2022 -
Unscored —
The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to e…
-
Unscored —
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and f…
-
Unscored —
An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allow…
-
Unscored —CVE-2019-12279 Public exploit
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). …