Skip to content
OpenAdvisories

Archive

June 2019

Vulnerabilities first published in this month (UTC), newest first.

← May 2019 2019 / June July 2019 →
  1. 11
  2. 24
  3. 396
  4. 436
  5. 5167
  6. 657
  7. 779
  8. 8 
  9. 9 
  10. 1023
  11. 1145
  12. 12126
  13. 1345
  14. 1449
  15. 158
  16. 161
  17. 1770
  18. 1850
  19. 1995
  20. 2056
  21. 2125
  22. 22 
  23. 233
  24. 2430
  25. 2526
  26. 2635
  27. 27108
  28. 2829
  29. 2915
  30. 3024
All Critical High Medium Low Exploited only Public exploit

99 results · Clear filters · Feed

  • Unscored —
    CVE-2019-12542 Public exploit

    An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID paramet…

  • Unscored —
    CVE-2019-12543 Public exploit

    An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceReque…

  • Unscored —
    CVE-2019-5392 Public exploit

    A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than v…

  • Unscored —
    CVE-2019-12735 Public exploit EPSS 19%

    getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via t…

    vim vim vim neovim Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2019-12616 Public exploit EPSS 20%

    phpMyAdmin CSRF Vulnerability

    An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAd…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist
  • Critical 9.0
    CVE-2019-10149 Exploited Public exploit EPSS 100%

    A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message…

    Exim Exim exim4 exim4 Debian Ubuntu Alpine
    KEV Jan 10, 2022
  • Critical 9.1
    CVE-2018-13382 Exploited · Ransomware Public exploit EPSS 82%

    An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and Fort…

    Fortinet Fortinet FortiOS, FortiProxy Network devices
    KEV Jan 10, 2022
  • Critical 9.1
    CVE-2018-13379 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5…

    Fortinet Fortinet FortiOS, FortiProxy Network devices
    KEV Nov 3, 2021
  • Unscored —
    CVE-2019-10009 Public exploit EPSS 11%

    A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated us…

  • Unscored —
    CVE-2019-11368 Public exploit

    Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.

  • Unscored —
    CVE-2019-12169 Public exploit EPSS 72%

    ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathna…

  • Unscored —
    CVE-2019-11369 Public exploit

    An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext pas…

  • Unscored —
    CVE-2019-11370 Public exploit Scanner template

    Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" …

  • Medium 4.7
    CVE-2019-6588 Public exploit

    Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API

    In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= ur…

    com.liferay.portal:release.portal.bom Maven
  • Unscored —
    CVE-2018-5404 Public exploit

    The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.

    The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the…

    Quest Kace K1000 Appliance
  • Unscored —
    CVE-2018-5405 Public exploit

    The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.

    The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the …

    Quest Kace K1000 Appliance
  • Unscored —
    CVE-2018-5406 Public exploit EPSS 12%

    The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.

    The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions …

    Quest Kace K1000 Appliance
  • Unscored —
    CVE-2019-12593 Public exploit Scanner template EPSS 41%

    IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/inde…

  • Critical 9.8
    CVE-2019-11580 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Atta…

    Atlassian Crowd
    KEV Nov 3, 2021