Archive
26 June 2019
Vulnerabilities first published on this day (UTC), newest first.
35 results · Feed
-
Critical 9.8
SQL Injection in Couchbase Sync Gateway
In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "_all…
-
Medium 6.5
Moodle all messaging conversations could be viewed
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
-
Medium 4.2
Moodle Private files uploaded via incoming mail processing could bypass quota restrictions
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
-
Low 3.1
Moodle Open Redirect Vulnerability
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
-
Unscored —
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux…
-
Unscored —
Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in …
-
Unscored —
Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape…
-
Unscored —
In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSB…
-
Unscored —
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/i…
-
Unscored —
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.
-
Unscored —
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.
-
Unscored —
ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c.
-
Unscored —
ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
-
Unscored —
A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid…
-
Unscored —
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers c…
-
Unscored —
An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in…
-
Unscored —
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_ne…
-
Unscored —
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJ…
-
High 7.5
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any…
-
Unscored —
The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via d…
-
Unscored —
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious …
-
Medium 5.9
IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default,…
-
High 8.4
IBM PureApplication System 2.2.3.0 through 2.2.5.3 could allow an authenticated user with local access to bypass authen…
-
Medium 4.3
IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor.…
-
Medium 4.4
IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be …
-
Medium 6.3
IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection. A remote attacker could send special…
-
High 8.8
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.
-
Medium 5.5
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow servic…
-
Medium 5.4
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery.
-
High 8.8
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.
-
Medium 6.5
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP.
-
High 7.3
PlaintextPasswordEncoder authenticates encoded passwords that are null
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a nu…
-
Unscored —
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. …
-
Unscored —
A vulnerability was found in the Sonic Robo Blast 2 (SRB2) plugin (EP_Versions 9 to 11 inclusive) distributed with Doom…
-
Unscored —
FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a"…