Archive
13 June 2019
Vulnerabilities first published on this day (UTC), newest first.
45 results · Feed
-
Unscored —
An issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt used for obfuscating t…
-
Unscored —
In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remo…
-
High 7.3
Prototype Pollution in @apollo/gateway
Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can…
-
Unscored —
BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13…
-
Unscored —
BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on…
-
Medium 6.5
Shopware Insecure Deserialization Vulnerability
In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deser…
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version 4.18.2 o…
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …
-
Medium 6.5
Command Injection in wiki-plugin-datalog
Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system. ## Recommendation…
-
High —
Regular Expression Denial of Service (ReDoS)
A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
-
High 7.3
Prototype Pollution in lutils-merge
All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial …
-
Unscored —
An issue was discovered in versions earlier than 1.3.2 for Polycom RealPresence Debut where the admin cookie is reset o…
-
Unscored —
An issue was discovered in versions earlier than 1.3.0-66872 for Polycom RealPresence Debut that allows attackers to ar…
-
Unscored —
Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vul…
-
Unscored —
An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, …
-
Unscored —
HiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability exists due to some DL…
-
Unscored —
There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick…
-
Unscored —
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code…
-
Unscored —
Improper permissions in the installer for Intel(R) Chipset Device Software (INF Update Utility) before version 10.1.1.4…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may …
-
Unscored —
Improper permissions in the installer for Intel(R) Turbo Boost Max Technology 3.0 driver version 1.0.0.1035 and before …
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical addr…
-
Unscored —
Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enabl…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unau…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…
-
Unscored —
Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthentica…
-
Unscored —
Insufficient session validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enab…
-
Unscored —
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable…
-
Unscored —
Pointer corruption in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation…
-
Unscored —
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escal…
-
Unscored —
Buffer overflow in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of…
-
Unscored —
Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentiall…