Archive
5 June 2019
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Medium —
Command Injection in dot
All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
-
Medium 5.9
Insecure Default Configuration in tesseract.js
Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations. ## Recommendation U…
-
Medium 4.7CVE-2019-1881 Public exploit
Cisco Industrial Network Director Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vul…
-
Medium 5.4
Cisco Industrial Network Director Stored Cross-Site Scripting Vulnerability
A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attac…
-
Medium 6.1
Cisco Enterprise Chat and Email Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an aff…
-
Medium 5.3
Cisco TelePresence Video Communication Server and Cisco Expressway Series Server-Side Request Forgery Vulnerability
A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper re…
-
Medium 4.4
Cisco Unified Computing System BIOS Signature Bypass Vulnerability
A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validat…
-
Medium 5.3
Cisco Webex Meetings Server Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information. The vulnerability is due to improper access control to files within the web-based mana…
-
Medium 5.4
Cisco IOS XR Software Secure Shell Authentication Vulnerability
A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that …
-
Medium 6.1
Cross-site Scripting in HAPI FHIR
XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/Base…
-
Medium 5.9
Denial of Service in js-yaml
Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service. ## Recommendation Upgrade to version 3.13.0.
-
Medium —
Denial of Service in canvas
Versions of `canvas` prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process. ## Recommendation Upgrade to version 1.6.10
-
Medium 5.9
Denial of Service in url-relative
All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service. ## Recommendation No fix is currently available. Consider using an alternati…
-
Medium —
Path Traversal in statics-server
All versions of `statics-server` are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. ## Recommendation No fix is currently available. Consider using an alternative module until a…
-
Medium 5.3
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion. ## Recommendation Upg…
-
Medium 6.5
phpMyAdmin CSRF Vulnerability
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAd…