Archive
June 2019
Vulnerabilities first published in this month (UTC), newest first.
1,303 results · Feed
-
Unscored —
LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification s…
-
Unscored —
An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0…
-
High 7.1
Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authen…
-
Unscored —CVE-2019-10993 EPSS 11%
In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote …
-
Unscored —
In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of prope…
-
Unscored —
In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validati…
-
Unscored —
In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack o…
-
Unscored —
In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack…
-
Unscored —
In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation o…
-
Medium 6.5
A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning fe…
-
Unscored —
Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remo…
-
Unscored —
The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XS…
-
Unscored —
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0…
-
Unscored —
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authent…
-
Unscored —
Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and…
-
Unscored —
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disabl…
-
Unscored —
Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterpr…
-
Unscored —
A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete sea…
-
Unscored —
LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.
-
Unscored —
LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.
-
Unscored —
LOYTEC LGATE-902 6.3.2 devices allow XSS.
-
Medium 5.3
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive…
-
Unscored —
Various Lexmark devices have a Buffer Overflow (issue 1 of 2).
-
Unscored —
Various Lexmark devices have a Buffer Overflow (issue 2 of 2).
-
Unscored —
On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and p…
-
Unscored —
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_…
-
Unscored —
In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environmen…
-
Unscored —
Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is re…
-
Medium 6.5
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and…
-
High 8.5
Directory Traversal vulnerability could lead to elevated privileges
Directory Traversal vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated privileges via specially crafted input.
-
High 8.0
Command Injection could allow authenticated users to execute arbitrary code
Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.
-
High 8.0
Command Injection could allow authenticated users to execute arbitrary code
Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.
-
High 8.3
Application protections bypass vulnerability could allow unauthenticated user to impersonate system users
Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters.
-
Medium —
Cross-Site Scripting via JSONP
JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.
-
Medium 6.5
Arbitrary Code Injection in mobile-icon-resizer
mobile-icon-resizer resizes large images for use as icons for iOS and Android. mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3. mobile-icon-resizer takes an options object as an argument to define the resulting icons as such: `…
-
Unscored —
The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user …
-
High 7.5
Privilege escalation could allow authenticated user to gain access to a core system
Privilege escalation in McAfee Enterprise Security Manager (ESM) 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control.
-
Unscored —
An issue was discovered in the Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 devices. An attacker ca…
-
Unscored —
The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI …
-
Unscored —
Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domai…