Archive
June 2019
Vulnerabilities first published in this month (UTC), newest first.
1,303 results · Feed
-
Unscored —
In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. …
-
Unscored —
In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc, there is a possible out-of-bound write due to a missing bounds check. Thi…
-
Unscored —
In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to …
-
Unscored —
In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK). If a BLE device were …
-
Unscored —
In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion. This c…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides certfile upload functionality so that…
-
Unscored —
In EffectRelease of EffectBundle.cpp, there is a possible memory corruption due to a double free. This could lead to lo…
-
Unscored —
In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race c…
-
Unscored —
In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks. This…
-
Unscored —
In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead t…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. Thi…
-
Unscored —
In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java, there is a possible permissions bypass due to …
-
Unscored —
In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java, there is a possible permissions bypass …
-
Unscored —
In isPackageDeviceAdminOnAnyUser of PackageManagerService.java, there is a possible permissions bypass due to a missing…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an adminis…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a web interface to allow an administrator to…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides alert functionality so that an administrator can sen…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can exec…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag.…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log…
-
Unscored —
An issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic thus providing an inse…
-
Critical 9.8
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 a…
-
Unscored —
SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection.
-
Unscored —
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3).
-
Unscored —
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3).
-
Unscored —
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3).
-
Unscored —
A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 whe…
-
Unscored —
A use after free in the TextBox field Mouse Enter action in IReader_ContentProvider can occur for specially crafted PDF…
-
Unscored —
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
-
Unscored —
admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection tha…
-
Unscored —
Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php…
-
Critical 9.8
aubio Buffer Overflow vulnerability
aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.
-
High 7.5
Aubio is vulnerable to a NULL pointer dereference in new_aubio_filterbank
aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.
-
High 7.5
Aubio is vulnerable to a NULL pointer dereference in new_aubio_notes function
aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.
-
Unscored —
Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspeci…
-
Unscored —
Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.
-
Unscored —
The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit loca…
-
Unscored —
In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugi…
-
Unscored —
An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allo…