Archive
3 June 2019
Vulnerabilities first published on this day (UTC), newest first.
96 results · Feed
-
Unscored —
An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. Ther…
-
Unscored —
An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel throug…
-
Unscored —
A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated us…
-
Unscored —
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leadi…
-
Unscored —
VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_lo…
-
Unscored —
VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php a…
-
Unscored —
Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the l…
-
Unscored —CVE-2019-10883 EPSS 65%
Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.
-
Unscored —
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This …
-
Unscored —
Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to c…
-
Unscored —
An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and prov…
-
Unscored —CVE-2019-11368 Public exploit
Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.
-
Unscored —
ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathna…
-
Unscored —CVE-2019-11369 Public exploit
An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext pas…
-
Unscored —
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execu…
-
Unscored —
Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" …
-
Medium 4.7CVE-2019-6588 Public exploit
Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= ur…
-
Unscored —
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0…
-
Unscored —
Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168…
-
Unscored —
A SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service…
-
Unscored —
Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows l…
-
Unscored —
Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead t…
-
Unscored —
Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service U…
-
Unscored —
Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.…
-
Unscored —
A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0…
-
Critical 9.1
A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. The vul…
-
High 8.6
The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a searc…
-
Unscored —
ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerabilit…
-
High 8.6
An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, du…
-
Critical 9.8
A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. The vulnerability is in the lo…
-
Medium 6.1
All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-sit…
-
Critical 9.8
An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affect…
-
High 8.0
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel modu…
-
Unscored —CVE-2018-5404 Public exploit
The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the…
-
Unscored —CVE-2018-5405 Public exploit
The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the …
-
Unscored —
The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions …
-
Unscored —
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard …
-
Medium 4.7
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…
-
High 7.0
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…
-
High 7.0
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…