Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
1,337 results · Feed
-
Low 3.3
IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a loca…
-
Medium 6.5
IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements …
-
Medium 5.3
IBM Storwize V7000 Unified (2073) 1.6 configuration may allow an attacker to reveal the server version in default insta…
-
Medium 5.4
IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the fun…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_imag…
-
Unscored —
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to dis…
-
Unscored —
In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in …
-
Unscored —
When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, lea…
-
Unscored —
When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due…
-
Unscored —
When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcp…
-
Unscored —
In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the cli…
-
Unscored —
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.
-
Unscored —
njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.
-
Unscored —
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.
-
Unscored —
An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data…
-
Unscored —
In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header.
-
Unscored —
eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may…
-
Unscored —
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequenc…
-
Unscored —
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an …
-
Unscored —
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AR…
-
Unscored —CVE-2019-12170 Public exploit
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) compone…
-
Unscored —
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administrat…
-
Unscored —
GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gat…
-
Unscored —
In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure An…
-
Unscored —
An issue was discovered in Falco through 0.14.0. A missing indicator for insufficient resources allows local users to b…
-
Unscored —
WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP address…
-
Unscored —
GoHTTP through 2017-07-25 has a sendHeader use-after-free.
-
Unscored —
GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via…
-
Unscored —
GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension.
-
Unscored —CVE-2018-16156 Public exploit
In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes …
-
High 7.5
Information exposure in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…
-
Unscored —
SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution.
-
Unscored —
SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL comm…
-
Unscored —
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLa…