Skip to content
OpenAdvisories

Archive

11 July 2019

Vulnerabilities first published on this day (UTC), newest first.

← June 2019 2019 / July /11 August 2019 →
  1. 160
  2. 268
  3. 397
  4. 448
  5. 561
  6. 619
  7. 74
  8. 833
  9. 937
  10. 1090
  11. 1184
  12. 1211
  13. 132
  14. 146
  15. 1585
  16. 1636
  17. 1768
  18. 1860
  19. 1950
  20. 20 
  21. 2113
  22. 2236
  23. 23244
  24. 2422
  25. 2569
  26. 2636
  27. 2720
  28. 2820
  29. 2987
  30. 3095
  31. 3162
All Critical High Medium Low Exploited only Public exploit

84 results · Feed

  • Unscored —
    CVE-2018-17152

    Intersystems Cache 2017.2.2.865.0 allows XXE.

  • Unscored —
    CVE-2018-17150

    Intersystems Cache 2017.2.2.865.0 allows XSS.

  • Critical 9.3
    CVE-2019-7003

    ACM SQL Injection

    A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Ma…

    Avaya Avaya Control Manager
  • Unscored —
    CVE-2019-12529

    An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is config…

    squid squid3 squid Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2019-10194

    Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficientl…

    Red Hat ovirt-engine-metrics
  • High 7.2
    CVE-2019-10192 EPSS 26%

    A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x …

    Redis Redis redis redis Debian Ubuntu Alpine
  • High 7.2
    CVE-2019-10193 EPSS 23%

    A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x…

    Redis Redis redis redis Debian Alpine
  • Medium 4.6
    CVE-2019-3889

    A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3…

    Red Hat atomic-openshift
  • Unscored —
    CVE-2019-11062

    SUNNET WMPro v5.0 and v5.1 has OS Command Injection

    The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.

    Sunnet WMPro
  • Critical 9.1
    CVE-2019-9886

    eClass platform allows user to download arbitrary files without authentication

    Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.

    BroadLearning eclass
  • Unscored —
    CVE-2019-12525 EPSS 24%

    An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authe…

    squid squid3 squid Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2019-11268

    UAA SQL Identity Zone Vulnerability

    Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private i…

    Cloud Foundry UAA Release (OSS)
  • Unscored —
    CVE-2019-12527 EPSS 50%

    An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid…

    squid Debian
  • Unscored —
    CVE-2019-10651

    An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 …

  • Unscored —
    CVE-2019-13564

    XSS exists in Ping Identity Agentless Integration Kit before 1.5.

  • Unscored —
    CVE-2019-13563

    D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.

  • Unscored —
    CVE-2019-13562

    D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr par…

  • Unscored —
    CVE-2019-13561

    D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metachara…

  • Unscored —
    CVE-2019-13560

    D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi s…

  • Medium 4.3
    CVE-2019-10342

    Missing permission check in Jenkins Docker Plugin

    A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

    Jenkins Project Jenkins Docker Plugin io.jenkins.docker:docker-plugin Web / CMS Maven
  • Medium 4.3
    CVE-2019-10351

    Jenkins Caliper CI Plugin stores credentials in plain text

    Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

    Jenkins Project Jenkins Caliper CI Plugin com.brianfromoregon:caliper-ci Web / CMS Maven
  • Medium 4.3
    CVE-2019-10350

    Jenkins Port Allocator Plugin stores credentials in plain text

    Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

    Jenkins Project Jenkins Port Allocator Plugin org.jenkins-ci.plugins:port-allocator Web / CMS Maven
  • Medium 6.5
    CVE-2019-10341

    Missing permission check in Jenkins Docker Plugin

    A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another…

    Jenkins Project Jenkins Docker Plugin io.jenkins.docker:docker-plugin Web / CMS Maven
  • Medium 5.4
    CVE-2019-10349 Public exploit

    Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting

    A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

    Jenkins Project Jenkins Dependency Graph Viewer Plugin org.jenkins-ci.plugins:depgraph-view Web / CMS Maven
  • High 8.8
    CVE-2019-10347

    Stored credentials unencrypted in Jenkins Mashup Portlets Plugin

    Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.

    Jenkins Project Jenkins Mashup Portlets Plugin javagh.jenkins:mashup-portlets-plugin Web / CMS Maven
  • High 8.8
    CVE-2019-10340

    Jenkins Docker Plugin contains Cross-Site Request Forgery

    A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained…

    Jenkins Project Jenkins Docker Plugin io.jenkins.docker:docker-plugin Web / CMS Maven
  • Medium 6.1
    CVE-2019-10346

    Jenkins Embeddable Build Status Plugin contains Cross-site Scripting

    A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.

    Jenkins Project Jenkins Embeddable Build Status Plugin io.jenkins.plugins:embeddable-build-status-plugin Web / CMS Maven
  • Medium 4.3
    CVE-2019-10348

    Jenkins Gogs Plugin stored credentials in plain text

    Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

    Jenkins Project Jenkins Gogs Plugin org.jenkins-ci.plugins:gogs-webhook Web / CMS Maven
  • Unscored —
    CVE-2018-11744

    Cloudera Manager through 5.15 has Incorrect Access Control.

  • Unscored —
    CVE-2019-13507

    hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.

  • Unscored —
    CVE-2019-12363

    An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a reque…

  • Unscored —
    CVE-2019-12537

    An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.

  • Unscored —
    CVE-2019-12539

    An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.d…

  • Unscored —
    CVE-2019-12540

    An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.

  • Unscored —
    CVE-2019-12595

    An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.

  • Unscored —
    CVE-2019-12596

    An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swT…

  • Unscored —
    CVE-2019-12597

    An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the paramete…

  • Medium 6.1
    CVE-2019-13506

    Cross-Site Scripting in @nuxt/devalue

    @nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.

    @nuxt/devalue npm
  • Unscored —
    CVE-2019-12838

    SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection.

    slurm-llnl Ubuntu
  • Unscored —
    CVE-2019-1010003

    Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).

    Leanote Leanote