Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
1,337 results · Feed
-
Unscored —
Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Aut…
-
Unscored —
Improper buffer length check before copying can lead to integer overflow and then a buffer overflow in WMA event handle…
-
Unscored —CVE-2019-10848 Public exploit
Computrols CBAS 18.0.0 allows Username Enumeration.
-
Unscored —
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-…
-
Unscored —
Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent:…
-
Unscored —
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartCo…
-
Unscored —
Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagCo…
-
Unscored —
An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_nots…
-
Unscored —
In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be ex…
-
Medium 6.1
PrestaShop Cross-site Scripting vulnerability
In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and condition…
-
Unscored —
Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor exten…
-
Unscored —
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
-
Unscored —CVE-2019-12195 Public exploit
TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking…
-
Unscored —
Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the …
-
Unscored —
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as…
-
Medium 6.1
Cross-Site Scripting in shave
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
-
Unscored —
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer d…
-
Medium 6.4
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a loca…
-
Unscored —
Incorrect command line processing in Chrome in Google Chrome prior to 73.0.3683.75 allowed a local attacker to perform …
-
Unscored —
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerabili…
-
Unscored —
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote atta…
-
Unscored —
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker t…
-
Unscored —
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform…
-
Unscored —
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass con…
-
Unscored —
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allo…
-
Unscored —
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an …
-
Unscored —CVE-2019-5796 Public exploit
Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially expl…
-
Unscored —
XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers.
-
Unscored —
Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out …
-
Unscored —
Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker…
-
Unscored —
Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initi…
-
Unscored —CVE-2019-10846 Public exploit
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and pass…
-
Unscored —
Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out …
-
Unscored —
Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of …
-
Unscored —
An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 a…
-
Unscored —CVE-2019-5789 Public exploit
An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed…
-
Unscored —CVE-2019-5788 Public exploit
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 all…
-
Unscored —
Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially e…
-
Unscored —CVE-2019-10849 Public exploit
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
-
Unscored —
Computrols CBAS 18.0.0 has Default Credentials.