Archive
June 2019
Vulnerabilities first published in this month (UTC), newest first.
1,303 results · Feed
-
Unscored —
Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of app…
-
Unscored —
Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider…
-
Unscored —
Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free t…
-
Unscored —
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_…
-
Unscored —
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_…
-
Unscored —
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_…
-
Unscored —
A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 700…
-
Unscored —
Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentia…
-
Unscored —
This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.
-
Unscored —
In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and unde…
-
Unscored —
Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadca…
-
Medium 5.9
IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to …
-
Medium 5.4
IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability a…
-
High 8.0
IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker…
-
Medium 5.9
IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by…
-
High 8.8
IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users …
-
Unscored —
Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com …
-
Unscored —
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows m…
-
Unscored —
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated us…
-
Unscored —
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated us…
-
Unscored —
Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi act…
-
Unscored —
The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external da…
-
Medium 4.3
IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive infor…
-
Medium 4.0
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read b…
-
Medium 4.3
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive inform…
-
Medium 5.9
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Use…
-
Medium 4.0
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. Th…
-
Medium 6.1
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking acti…
-
Unscored —
Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 k…
-
Unscored —CVE-2019-11523 Public exploit
Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption…
-
Unscored —
Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creat…
-
Medium 6.1
Ops Manager uaa client issues tokens after refresh token expiration
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain a…
-
Critical 9.1
Web Parameter Tampering Vulnerability
Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauthenticated attacker could potentially manipulate parameters of web requests to OMSA to create arbitra…
-
High 7.5
XML External Entity (XXE) Injection Vulnerability
Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary serve…
-
Unscored —
VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architectur…
-
Unscored —
VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with …
-
High 7.5
Code Injection in PyXDG
A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This i…
-
Low 3.3
A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loa…
-
Unscored —
vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and prob…
-
Unscored —
An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifyin…