Archive
10 June 2019
Vulnerabilities first published on this day (UTC), newest first.
23 results · Feed
-
Unscored —
Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on a…
-
Unscored —
The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the devi…
-
Medium 4.7CVE-2019-11881 Public exploit
Rancher Login Parameter Can Be Edited
A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special characters or symbols. There's no other limitation of the message, allowing malici…
-
Critical 9.8
ruby-openid SSRF via claimed_id request
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to e…
-
Unscored —
In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. Th…
-
Unscored —CVE-2019-12788 Public exploit
An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges)…
-
Unscored —
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP…
-
Unscored —
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP…
-
Unscored —
WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-20…
-
Unscored —
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on…
-
Unscored —
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible,…
-
Unscored —
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever…
-
Unscored —
XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows attackers to steal credential…
-
Unscored —
An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mo…
-
Unscored —
An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in m…
-
Unscored —
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data functi…
-
Unscored —
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data fun…
-
Unscored —
Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Li…
-
Unscored —
In Bevywise MQTTRoute 1.1 build 1018-002, a connect packet combined with a malformed unsubscribe request packet can be …
-
Unscored —
The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the Set…
-
Unscored —
There is a Clickjacking vulnerability in Huawei HG255s product. An attacker may trick user to click a link and affect t…
-
Medium 6.1
Twisted CRLF Injection
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
-
Unscored —CVE-2019-10226 Public exploit
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to t…