Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
1,337 results · Feed
-
Medium 5.9
Access control bypass in Apache ZooKeeper
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plainte…
-
Unscored —
Leanify 0.4.3 allows remote attackers to trigger an out-of-bounds write (1024 bytes) via a modified input file.
-
Unscored —
Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentS…
-
Unscored —
In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could sen…
-
Unscored —
Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmwa…
-
Unscored —
An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled F…
-
Unscored —
wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client…
-
Unscored —
In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed…
-
Medium —
Cryptographically Weak PRNG in generate-password
Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords. ## Recommendation Update to version 1.4.1 or later.
-
Medium —
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure. Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password. Only `mysql` running on Node.js versions below…
-
Medium 6.3
Cross-Site Scripting in webpack-bundle-analyzer
Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting. ## Recommendation Upgrade to version 3.3.2 or later.
-
Unscored —
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with…
-
Unscored —
A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.…
-
Unscored —CVE-2018-7844 Public exploit
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum…
-
Unscored —
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quan…
-
Unscored —
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum…
-
Unscored —
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, a…
-
Unscored —
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
-
Unscored —CVE-2018-7854 Public exploit
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, a…
-
Unscored —
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
High 7.5CVE-2018-7852 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —CVE-2018-7845 Public exploit
A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —
A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580…
-
Unscored —
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quan…
-
Unscored —
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Mo…
-
Unscored —CVE-2018-7848 Public exploit
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum…
-
Unscored —CVE-2018-7843 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
Unscored —CVE-2018-7849 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum a…
-
Unscored —
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon…
-
Unscored —
CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware pr…
-
Unscored —
In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware m…
-
Unscored —
In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could ca…
-
Unscored —
A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which c…
-
Unscored —
A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a spec…
-
Unscored —
A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19…
-
Unscored —
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denia…