Archive
8 July 2019
Vulnerabilities first published on this day (UTC), newest first.
33 results · Feed
-
Unscored —
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because …
-
Unscored —
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it…
-
Unscored —
MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated use…
-
Unscored —
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploit…
-
Unscored —
In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not im…
-
Unscored —
A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to …
-
Unscored —
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions …
-
Unscored —
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed cred…
-
Unscored —
In multiple functions of key_store_service.cpp, there is a possible Information Disclosure due to improper locking. Thi…
-
Unscored —
In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead …
-
Unscored —
In checkQueryPermission of TelephonyProvider.java, there is a possible disclosure of secure data due to a missing permi…
-
Unscored —
In save_attr_seq of sdp_discovery.cc, there is a possible out-of-bound read due to a missing bounds check. This could l…
-
Unscored —
In setup wizard there is a bypass of some checks when wifi connection is skipped. This could lead to factory reset prot…
-
Unscored —
In several functions of alarm.cc, there is possible memory corruption due to a use after free. This could lead to local…
-
Unscored —
In loop of DnsTlsSocket.cpp, there is a possible heap memory corruption due to a use after free. This could lead to rem…
-
Unscored —
In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bou…
-
Unscored —CVE-2019-2107 Public exploit
In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. T…
-
Unscored —
In ihevcd_sao_shift_ctb of ihevcd_sao.c, there is a possible out of bounds write due to a missing bounds check. This co…
-
Unscored —
In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data. This…
-
Unscored —
In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. …
-
Unscored —
Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leverag…
-
Critical 9.8
strong_password Ruby gem malicious version causing Remote Code Execution vulnerability
The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6.
-
Unscored —
The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
-
Unscored —
The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
-
Unscored —
hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:config…
-
Unscored —
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartex…
-
Unscored —
An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could b…
-
Unscored —
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for…
-
Unscored —
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices…
-
Unscored —
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
-
Unscored —
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext.…
-
Unscored —
Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversati…
-
Unscored —
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a C…