Archive
24 June 2019
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc w…
-
Unscored —
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the ind…
-
Unscored —
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffe…
-
Unscored —
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) applicati…
-
Unscored —
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs…
-
Unscored —
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to X…
-
Unscored —
The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. Thi…
-
Unscored —
BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_ac…
-
Unscored —
The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.
-
Unscored —
Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScrip…
-
Unscored —
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover pict…
-
Unscored —
CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privi…
-
Unscored —
Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via t…
-
Unscored —
The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utiliza…
-
Unscored —
The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authen…
-
Unscored —CVE-2019-7232 EPSS 52%
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host …
-
High 7.5
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…
-
Unscored —
Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.
-
Unscored —CVE-2019-12323 Public exploit
The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.
-
Unscored —
An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4…
-
Medium 5.9
Deserialization of Untrusted Data in FasterXML jackson-databind
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
-
Unscored —
A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4.…
-
Unscored —
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86…
-
Unscored —
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86…
-
Unscored —
LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a larg…
-
Unscored —
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
-
Unscored —
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86…
-
Unscored —
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with …
-
Unscored —
The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to ach…
-
Unscored —
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remot…