Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
123 results · Clear filters · Feed
-
High —
Cross-Site Scripting in react-svg
Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default. ## Recommendation Update to version 2.2.18 or later.
-
High —
Out-of-bounds Read in base64-url
Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input. ## Recommendation Update to version 2.0.0 or later.
-
High 7.5
Path Traversal in angular-http-server
Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal. ## Recommendation Update to version 1.4.4 or later.
-
High 7.3
Prototype Pollution in deap
Versions of `deap` before 1.0.1 are vulnerable to prototype pollution. ## Recommendation Update to version 1.0.1 or later.
-
High 7.5
Denial of Service in foreman
All versions of `foreman` are vulnerable to Regular Expression Denial of Service when requests to it are made with a specially crafted path. ## Recommendation Upgrade to version 3.0.1.
-
High 8.8
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to e…
KEV Mar 26, 2025 -
High 8.1
XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin
An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML …
-
High 8.8
Plaintext password storage in Jenkins InfluxDB Plugin
Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
High 7.5
Improper handling of untrusted branches in Gitea Jenkins Plugin
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
-
High 7.5
Hybrid Group Gobot Improper Certificate Validation vulnerability
An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.
-
High —
Cross-Site Scripting in bracket-template
All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template. ## Recommendation No fix is currently available for this vulnerability. It is our …
-
High 7.5
Improper Key Verification in ipns
Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid. ## Recommendation Update to version 0.1.3 or later.
-
High —
Directory Traversal in ltt.js
Affected versions of `ltt.js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private fil…
-
High 7.1
A researcher has disclosed several vulnerabilities against FortiClient for Windows version 6.0.5 and below, version 5.6…
-
High 8.8
Privilege escalation vulnerability in Apache Hadoop
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
-
High —
Server-Side Request Forgery in terriajs-server
Versions of `terriajs-server`prior to 2.7.4 are vulnerable to Server-Side Request Forgery (SSRF). If an attacker has access to a server whitelisted by the terriajs-server proxy or if the attacker is able to modify the DNS records of a domain whitelisted by th…
-
High 7.5
Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)
A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in reading or modification of the SHC's configuration or triggering and restoring backups. In order to e…
-
High 8.0
Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)
A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the…
-
High 7.5
Containous Traefik Exposes Password Hashes
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover …
-
High 7.4
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular conf…
-
High 8.6
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via netwo…
-
High 7.8CVE-2019-5436 EPSS 50%
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4…
-
High 7.5
XML External Entity injection in Apache Camel
Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
-
High 7.4
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute c…
-
High 7.5CVE-2018-7852 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denia…
-
High 8.2
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device…
-
High 7.5
An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all vers…
-
High 8.8
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A …
-
High 8.1
Deserialization of Untrusted Data in Hazelcast
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attack…
-
High 7.5
Information exposure in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…
-
High 7.5
Improper authentication in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabl…
-
High 7.1
Deserialization of untrusted data in Symfony
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has …
-
High 7.3
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6…
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2…
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2…
-
High 7.5
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0914, CVE-2…