Archive
June 2019
Vulnerabilities first published in this month (UTC), newest first.
1,303 results · Feed
-
Unscored —
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) applicati…
-
Unscored —
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs…
-
Unscored —
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to X…
-
Unscored —
The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. Thi…
-
Unscored —
BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_ac…
-
Unscored —
The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.
-
Unscored —
Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScrip…
-
Unscored —
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover pict…
-
Unscored —
CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privi…
-
Unscored —
Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via t…
-
Unscored —
The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utiliza…
-
Unscored —
The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authen…
-
Unscored —CVE-2019-7232 EPSS 52%
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host …
-
High 7.5
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…
-
Unscored —
Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.
-
Unscored —CVE-2019-12323 Public exploit
The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.
-
Unscored —
An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4…
-
Medium 5.9
Deserialization of Untrusted Data in FasterXML jackson-databind
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
-
Unscored —
A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4.…
-
Unscored —
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86…
-
Unscored —
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86…
-
Unscored —
LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a larg…
-
Unscored —
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
-
Unscored —
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86…
-
Unscored —
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with …
-
Unscored —
The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to ach…
-
Unscored —
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remot…
-
Unscored —CVE-2019-12937 Public exploit
apps/gsudo.c in gsudo in ToaruOS through 1.10.9 has a buffer overflow allowing local privilege escalation to the root u…
-
High 7.1
BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions.
-
High 7.4CVE-2019-12935 Scanner template
Shopware Cross-site Scripting Vulnerability
Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.
-
Unscored —
Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.
-
Unscored —
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.C…
-
Unscored —
BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.
-
Unscored —
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the Fil…
-
Unscored —
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishan…
-
High 7.5CVE-2019-10072 EPSS 73%
Improper Locking in Apache Tomcat
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients wer…
-
Unscored —
Akamai CloudTest before 58.30 allows remote code execution.
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows coul…
-
Unscored —
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due …
-
Medium 6.5
Argument Injection in Apache Geode server
When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the c…