Skip to content
OpenAdvisories

Archive

3 June 2019

Vulnerabilities first published on this day (UTC), newest first.

← May 2019 2019 / June /3 July 2019 →
  1. 11
  2. 24
  3. 396
  4. 436
  5. 5167
  6. 657
  7. 779
  8. 8 
  9. 9 
  10. 1023
  11. 1145
  12. 12126
  13. 1345
  14. 1449
  15. 158
  16. 161
  17. 1770
  18. 1850
  19. 1995
  20. 2056
  21. 2125
  22. 22 
  23. 233
  24. 2430
  25. 2526
  26. 2635
  27. 27108
  28. 2829
  29. 2915
  30. 3024
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 4.7
    CVE-2019-6588 Public exploit

    Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API

    In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= ur…

    com.liferay.portal:release.portal.bom Maven
  • Medium 6.1
    CVE-2017-14850

    All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-sit…

  • Medium 4.7
    CVE-2019-10147

    rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…

    [UNKNOWN] rkt rkt Ubuntu
  • Medium 6.5
    CVE-2019-6741

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 p…

    Samsung Galaxy S9
  • Medium 5.5
    CVE-2019-3895

    Openstack Octavia Access Control Vulnerability

    An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a …

    Red Hat openstack-tripleo-common octavia octavia Ubuntu PyPI
  • Medium —
    GHSA-wrw9-m778-g6mc

    Memory Exposure in bl

    Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure. `bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory ## Recommendation Update to version 0.9.5, 1.0.1 or l…

    bl npm
  • Medium —
    GHSA-g74r-ffvr-5q9f

    Memory Exposure in concat-stream

    Versions of `concat-stream` before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into `write()` Versions <1.3.0 are not affected due to not using unguarded Buffer constructor. ## Recommendation Update to version 1.5.2, 1.4.11, 1.3.…

    concat-stream npm
  • Medium —
    GHSA-xc7v-wxcw-j472

    Memory Exposure in tunnel-agent

    Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number. Proof-of-concept: ```js require('request')({ method: 'GET', uri: 'http://www.example.com', tun…

    tunnel-agent npm
  • Medium 6.1
    CVE-2019-12308

    Django Cross-site Scripting in AdminURLFieldWidget

    An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value sto…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 6.8
    CVE-2019-12591

    NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.