Archive
June 2019
Vulnerabilities first published in this month (UTC), newest first.
24 results · Clear filters · Feed
-
Low 3.1
Moodle Open Redirect Vulnerability
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
-
Low 3.7
IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could …
-
Low 3.1
Uninitialized read in gdImageCreateFromXbm
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the functi…
-
Low —
Low severity vulnerability that affects Gw2Sharp
## Leaking cached authenticated requests ### Impact If you've been using one `MemoryCacheMethod` object in multiple instances of `Gw2WebApiClient` and are requesting authenticated endpoints with different access tokens, then you are likely to run into this bu…
-
Low 3.1
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are enc…
-
Low 3.3
A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loa…
-
Low 3.1
express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison
Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency o…
-
Low 2.1
IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previo…
-
Low —
Regular Expression Denial of Service in clean-css
Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial …
-
Low 3.5
Sensitive Data Exposure in sequelize-cli
Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text. ## Recommen…
-
Low —
Command Injection in opencv
Versions of `opencv`prior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands. ## Recommendation Upgrade to version 6.1.0.
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Studi…
-
Low 3.3CVE-2019-6753 EPSS 11%
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Phant…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Phant…
-
Low 3.5
An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5. An attacker who is logged into OTRS as a…
-
Low 3.7
ircdkit vulnerable to Denial of Service due to unhandled connection end event
Versions of `ircdkit` 1.0.3 and prior are vulnerable to a remote denial of service. ## Recommendation Upgrade to version 1.0.4.
-
Low 3.5
Additional information exposure with Spring Data JPA example matcher
This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than a…