Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
111 results · Clear filters · Feed
-
Unscored —CVE-2019-12102 Public exploit
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/fo…
-
Unscored —CVE-2019-12189 Public exploit
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
-
Unscored —CVE-2019-12252 Public exploit
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post…
-
Medium 6.1CVE-2019-10078 Public exploit
Cross-site Scriptin in JSPWiki
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were …
-
Medium 6.1CVE-2019-10077 Public exploit
Cross-site Scripting in JSPWiki
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
-
Medium 6.1CVE-2019-10076 Public exploit
Cross-Site Scripting in JSPWiki
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
-
Unscored —CVE-2019-8352 Public exploit
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials se…
-
Unscored —
eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may…
-
Unscored —CVE-2019-12170 Public exploit
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) compone…
-
Unscored —CVE-2018-16156 Public exploit
In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes …
-
High 7.5
Information exposure in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…
-
Unscored —
An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface…
-
Critical 9.0
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with…
-
Unscored —
GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injectio…
-
Unscored —
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabe…
-
Unscored —
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zo…
-
Unscored —CVE-2019-8928 Public exploit
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userMa…
-
Unscored —CVE-2019-8927 Public exploit
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zo…
-
Unscored —CVE-2019-8926 Public exploit
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zo…
-
Unscored —
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerab…
-
Unscored —CVE-2019-8924 Public exploit
XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued.
-
Medium 5.4CVE-2019-10909 Public exploit
Symfony Cross-site Scripting (XSS) vulnerability
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
-
Unscored —CVE-2019-0881 Public exploit
An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows…
-
High 7.8
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Err…
KEV Nov 3, 2021 -
Critical 9.8
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an una…
KEV Nov 3, 2021 -
Unscored —CVE-2019-12137 Public exploit
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ subst…
-
High 8.8
Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating …
-
Unscored —CVE-2019-11224 Public exploit
HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection.
-
Critical 9.8
Command Injection in Xstream
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g.…
-
Unscored —CVE-2019-8936 Public exploit
NTP through 4.2.8p12 has a NULL Pointer Dereference.
-
Unscored —CVE-2019-5526 Public exploit
VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by …
-
Unscored —
In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dy…
-
Unscored —CVE-2019-8978 Public exploit
An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web T…
-
Unscored —CVE-2019-11419 Public exploit
vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause…
-
Unscored —CVE-2019-8923 Public exploit
XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discon…
-
Unscored —CVE-2019-8404 Public exploit
An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafte…
-
Unscored —CVE-2019-8391 Public exploit
qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
-
Unscored —
qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.
-
Unscored —CVE-2018-18800 Public exploit
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p…
-
Unscored —
The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.