Archive
June 2019
Vulnerabilities first published in this month (UTC), newest first.
1,303 results · Feed
-
Unscored —
Metadata verification and partial hash system calls by bootloader may corrupt parallel hashing state in progress result…
-
Unscored —
While deserializing any key blob during key operations, buffer overflow could occur, exposing partial key information i…
-
Unscored —
The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis leading to potentially forg…
-
Unscored —
Out of bounds memory read and access may lead to unexpected behavior in GNSS XTRA Parser in Snapdragon Auto, Snapdragon…
-
Unscored —
Out-of-Bounds write due to incorrect array index check in PMIC in Snapdragon Auto, Snapdragon Compute, Snapdragon Consu…
-
Unscored —
Due to missing permissions in Android Manifest file, Sensitive information disclosure issue can happen in PCI RCS app i…
-
Unscored —
Out of bounds memory read and access due to improper array index validation may lead to unexpected behavior while decod…
-
Unscored —
Out-of-Bounds access in TZ due to invalid index calculated to check against DDR in Snapdragon Auto, Snapdragon Connecti…
-
Unscored —
Truncated access authentication token leads to weakened access control for stored secure application data in Snapdragon…
-
Unscored —
Kernel can inject faults in computations during the execution of TrustZone leading to information disclosure in Snapdra…
-
High 7.5
Directory Traversal in lactate
A crafted `GET` request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on …
-
Medium —
Regular Expression Denial of Service in underscore.string
Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS). The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows …
-
Critical 10.0
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
Versions of `constantinople` prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution. ## Recommendation Update to version 3.1.1 or later.
-
Critical —
Failure to sanitize quotes which can lead to sql injection in squel
All versions of `squel` are vulnerable to sql injection. The `squel` package does not properly escape user provided input when provided using the `setFields` method. This could lead to sql injection if the query was then executed. Proof of concept demonstrati…
-
Medium 5.4
IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip…
-
Medium 6.2
IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which …
-
Medium 5.9
IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced nod…
-
Medium 5.9
A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/ne…
-
Unscored —
An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3,…
-
Unscored —
In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over…
-
Medium 4.3
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorizat…
-
Unscored —
In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assert…
-
Unscored —
An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c…
-
Unscored —
An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c …
-
Unscored —
An issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt used for obfuscating t…
-
Unscored —
In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remo…
-
High 7.3
Prototype Pollution in @apollo/gateway
Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can…
-
Unscored —
BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13…
-
Unscored —
BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on…
-
Medium 6.5
Shopware Insecure Deserialization Vulnerability
In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deser…
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version 4.18.2 o…
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …
-
Medium 6.5
Command Injection in wiki-plugin-datalog
Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system. ## Recommendation…
-
High —
Regular Expression Denial of Service (ReDoS)
A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
-
High 7.3
Prototype Pollution in lutils-merge
All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial …
-
Unscored —
An issue was discovered in versions earlier than 1.3.2 for Polycom RealPresence Debut where the admin cookie is reset o…
-
Unscored —
An issue was discovered in versions earlier than 1.3.0-66872 for Polycom RealPresence Debut that allows attackers to ar…
-
Unscored —
Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vul…
-
Unscored —
An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, …