Archive
9 July 2019
Vulnerabilities first published on this day (UTC), newest first.
37 results · Feed
-
Critical 9.9
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.
-
Unscored —
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to e…
-
Unscored —
PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.
-
Unscored —
MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.
-
Unscored —
Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality…
-
Unscored —
Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an UR…
-
Unscored —
Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that conta…
-
Unscored —
KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.
-
Critical 9.8
Contao SQL injection in the file manager
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
-
Unscored —
TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizar…
-
Unscored —
Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is int…
-
Unscored —
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token…
-
Unscored —
In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wik…
-
Unscored —
TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an…
-
Unscored —
HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4. HPE 3PAR Service Process…
-
Unscored —
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can byp…
-
Unscored —
A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privi…
-
Medium 5.3
field_test gem contains injection vulnerability
The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbit…
-
Unscored —
The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM use…
-
Unscored —
In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure…
-
Unscored —
Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows ro…
-
Unscored —
Arlo Basestation firmware 1.12.0.1_27940 and prior firmware contain a networking misconfiguration that allows access to…
-
Unscored —
iart.php in XAMPP 1.7.0 has XSS, a related issue to CVE-2008-3569.
-
Unscored —
Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all …
-
Unscored —
Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary …
-
Unscored —
ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
-
Unscored —
Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely a…
-
Critical 9.8
Deserialization of Untrusted Data in jackson-databind
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
-
Unscored —
An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a lo…
-
Medium 6.1
Typo3 Cross-Site Scripting in Link Handling
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
-
High 8.8
TYPO3 Vulnerable to Insecure Deserialization
TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
-
Unscored —
Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN floo…
-
Unscored —
Sony BRAVIA Smart TV devices allow remote attackers to cause a denial of service (device hang) via a crafted web page o…
-
Unscored —
Intuit Lacerte 2017 has Incorrect Access Control.
-
Unscored —
An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulne…
-
Unscored —
In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a …
-
Unscored —
In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a …