Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
111 results · Clear filters · Feed
-
Unscored —
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arb…
-
Unscored —CVE-2018-18912 Public exploit
An issue was discovered in Easy File Sharing (EFS) Web Server 7.2. A stack-based buffer overflow vulnerability occurs w…
-
Unscored —CVE-2019-11429 Public exploit
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro…
-
Unscored —
D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1…
-
Unscored —
System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system c…
-
Unscored —
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that…
-
Unscored —CVE-2019-7652 Public exploit
TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the…
-
Unscored —CVE-2019-7181 Public exploit
Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the p…
-
Unscored —
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vaul…
-
Unscored —CVE-2019-11398 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitr…
-
Critical 9.9
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthen…
KEV Nov 3, 2021 -
Unscored —CVE-2019-11564 Public exploit
A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or H…
-
Unscored —
MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
-
Unscored —CVE-2019-7541 Public exploit
Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.
-
High 7.5CVE-2019-10742 Public exploit
Denial of Service in axios
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
-
Unscored —CVE-2018-20503 Public exploit
Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.
-
Unscored —
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
-
Unscored —CVE-2019-10869 Public exploit
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uplo…
-
Unscored —CVE-2019-11569 Public exploit
Veeam ONE Reporter 9.5.0.3201 allows CSRF.
-
Unscored —CVE-2019-10999 Public exploit
The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The …
-
Unscored —
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() ca…
-
Medium 6.5
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A mal…
-
Unscored —CVE-2018-20580 Public exploit
The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java c…
-
High 7.8CVE-2019-11687 Public exploit
An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing i…
-
Unscored —
DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the …
-
Unscored —
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerabil…
-
Unscored —
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default pass…
-
Unscored —
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in …
-
Unscored —
The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote…
-
Critical 9.8
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injec…
KEV Aug 7, 2023 -
High 7.5
Server Side Request Forgery in Apache Axis
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from so…