Archive
June 2019
Vulnerabilities first published in this month (UTC), newest first.
1,303 results · Feed
-
Unscored —
Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid da…
-
Unscored —
A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (lar…
-
Unscored —
An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG…
-
Unscored —
An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG…
-
Unscored —
Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c
-
Unscored —
Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.
-
Unscored —
Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated b…
-
Unscored —
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP …
-
Unscored —
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000030ecfa.
-
Unscored —
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000026b739.
-
Unscored —
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a.
-
Unscored —
Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. I…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows re…
-
Medium 5.5
Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated user…
-
High 7.3
OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote…
-
Medium 4.3
Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before…
-
High 7.3
SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977…
-
Medium 6.5
Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers…
-
High 8.0
Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote…
-
Unscored —
Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's…
-
Unscored —
Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScrip…
-
Unscored —
A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a deni…
-
Medium 6.5
http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer…
-
Unscored —
A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to ca…
-
Unscored —
njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after …
-
Unscored —
Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live dec…
-
Unscored —
The Logitech R500 presentation clicker allows attackers to determine the AES key, leading to keystroke injection. On Wi…
-
Unscored —
Logitech Unifying devices allow keystroke injection, bypassing encryption. The attacker must press a "magic" key combin…
-
Unscored —
Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack.
-
Unscored —
Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed.
-
Unscored —
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes …
-
Unscored —
An integer wrap in kernel/sys/syscall.c in ToaruOS 1.10.10 allows users to map arbitrary kernel pages into userland pro…
-
Unscored —
kernel/sys/syscall.c in ToaruOS through 1.10.9 allows a denial of service upon a critical error in certain sys_sbrk all…
-
Unscored —
kernel/sys/syscall.c in ToaruOS through 1.10.9 has incorrect access control in sys_sysfunc case 9 for TOARU_SYS_FUNC_SE…
-
Unscored —
linker/linker.c in ToaruOS through 1.10.9 has insecure LD_LIBRARY_PATH handling in setuid applications.
-
Unscored —
Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending…
-
Unscored —
Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraF…
-
Unscored —
mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the …
-
Medium 5.4
Grafana Cross-site Scripting vulnerability
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
-
Unscored —
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() o…