Archive
17 June 2019
Vulnerabilities first published on this day (UTC), newest first.
70 results · Feed
-
Unscored —
In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.
-
Unscored —
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope th…
-
Unscored —
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope th…
-
Unscored —
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope th…
-
Unscored —
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope th…
-
Unscored —
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope th…
-
Unscored —
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope th…
-
Unscored —
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope th…
-
Medium 5.8
An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the Ready…
-
Critical 10.0
An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the Ready…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that ar…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that ar…
-
Unscored —
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
-
Unscored —
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HT…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that ar…
-
Unscored —
A use after free in the TextBox field Validate action in IReader_ContentProvider can occur for specially crafted PDF fi…
-
Unscored —
A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 whe…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that ar…
-
Unscored —
A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the J…
-
Unscored —
An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to…
-
Unscored —
A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when p…
-
Unscored —
In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader_ContentProvider::GetDocEventH…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called …
-
Unscored —
A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the J…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface …
-
Unscored —
A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a l…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called…
-
Unscored —
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called…
-
Unscored —
OX App Suite 7.10.0 and earlier has Incorrect Access Control.
-
High 7.5
RubyGems Escape sequence injection vulnerability in verbose
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
-
High 7.5
RubyGems Escape sequence injection vulnerability in gem owner
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
-
High 7.5
RubyGems Escape sequence injection vulnerability in api response handling
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
-
High 7.5
RubyGems Escape sequence injection in errors
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
-
High 8.8
Code injection in RubyGems
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec du…
-
Unscored —
Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal…
-
Unscored —
An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to br…
-
Unscored —
app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a la…
-
Unscored —
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerabil…
-
Unscored —CVE-2019-11408 Public exploit
XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated a…
-
Unscored —
An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046…