Skip to content
OpenAdvisories

Archive

3 June 2019

Vulnerabilities first published on this day (UTC), newest first.

← May 2019 2019 / June /3 July 2019 →
  1. 11
  2. 24
  3. 396
  4. 436
  5. 5167
  6. 657
  7. 779
  8. 8 
  9. 9 
  10. 1023
  11. 1145
  12. 12126
  13. 1345
  14. 1449
  15. 158
  16. 161
  17. 1770
  18. 1850
  19. 1995
  20. 2056
  21. 2125
  22. 22 
  23. 233
  24. 2430
  25. 2526
  26. 2635
  27. 27108
  28. 2829
  29. 2915
  30. 3024
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Unscored —
    CVE-2019-10009 Public exploit EPSS 11%

    A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated us…

  • Unscored —
    CVE-2019-11368 Public exploit

    Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.

  • Unscored —
    CVE-2019-12169 Public exploit EPSS 72%

    ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathna…

  • Unscored —
    CVE-2019-11369 Public exploit

    An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext pas…

  • Unscored —
    CVE-2019-11370 Public exploit Scanner template

    Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" …

  • Medium 4.7
    CVE-2019-6588 Public exploit

    Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API

    In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= ur…

    com.liferay.portal:release.portal.bom Maven
  • Unscored —
    CVE-2018-5404 Public exploit

    The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.

    The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the…

    Quest Kace K1000 Appliance
  • Unscored —
    CVE-2018-5405 Public exploit

    The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.

    The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the …

    Quest Kace K1000 Appliance
  • Unscored —
    CVE-2018-5406 Public exploit EPSS 12%

    The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.

    The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions …

    Quest Kace K1000 Appliance
  • Unscored —
    CVE-2019-12593 Public exploit Scanner template EPSS 41%

    IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/inde…

  • Critical 9.8
    CVE-2019-11580 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Atta…

    Atlassian Crowd
    KEV Nov 3, 2021