Skip to content
OpenAdvisories

Archive

21 June 2019

Vulnerabilities first published on this day (UTC), newest first.

← May 2019 2019 / June /21 July 2019 →
  1. 11
  2. 24
  3. 396
  4. 436
  5. 5167
  6. 657
  7. 779
  8. 8 
  9. 9 
  10. 1023
  11. 1145
  12. 12126
  13. 1345
  14. 1449
  15. 158
  16. 161
  17. 1770
  18. 1850
  19. 1995
  20. 2056
  21. 2125
  22. 22 
  23. 233
  24. 2430
  25. 2526
  26. 2635
  27. 27108
  28. 2829
  29. 2915
  30. 3024
All Critical High Medium Low Exploited only Public exploit

25 results · Feed

  • Unscored —
    CVE-2019-10028

    Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.

    Netflix Dial Reference Source Code Repo (https://github.com/Netflix/dial-reference)
  • Unscored —
    CVE-2019-10718

    BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.C…

  • Unscored —
    CVE-2019-11392

    BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.

  • Unscored —
    CVE-2019-10720

    BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the Fil…

  • Unscored —
    CVE-2019-10719

    BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishan…

  • High 7.5
    CVE-2019-10072 EPSS 73%

    Improper Locking in Apache Tomcat

    The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients wer…

    tomcat8 tomcat9 tomcat9 org.apache.tomcat.embed:tomcat-embed-core Debian Ubuntu Maven
  • Unscored —
    CVE-2019-11011

    Akamai CloudTest before 58.30 allows remote code execution.

  • Unscored —
    CVE-2019-12572

    A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows coul…

  • Unscored —
    CVE-2019-10270

    An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due …

  • Medium 6.5
    CVE-2017-15694

    Argument Injection in Apache Geode server

    When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the c…

    org.apache.geode:geode-core Maven
  • Unscored —
    CVE-2019-12836 Public exploit

    The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can …

  • Unscored —
    CVE-2018-15665

    An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0. Unauthenticated users can get a …

  • Unscored —
    CVE-2018-15729

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vuln…

  • Unscored —
    CVE-2018-15730

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vuln…

  • Unscored —
    CVE-2018-15731

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vuln…

  • Unscored —
    CVE-2018-15732

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulne…

  • Unscored —
    CVE-2018-15733

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a NULL Pointer Dereferen…

  • Unscored —
    CVE-2018-15734

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulne…

  • Unscored —
    CVE-2018-15735

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulne…

  • Unscored —
    CVE-2018-15736

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vuln…

  • Unscored —
    CVE-2018-15737

    An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vuln…

  • Critical 9.8
    CVE-2016-7404

    Openstack Magnum Unsafe Credential Handling

    OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the u…

    magnum openstack-magnum magnum Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2018-15747

    glot-code-runner RCE

    The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

    github.com/prasmussen/glot-code-runner Go
  • Unscored —
    CVE-2018-15868

    SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arb…

  • High 8.8
    CVE-2019-1904

    Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for th…

    Cisco Cisco IOS XE Software iOS Network devices