Archive
18 July 2019
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Unscored —
Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability. Successful exploitation cou…
-
Unscored —
Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. Successful exploitatio…
-
Unscored —
Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitati…
-
Unscored —
Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. Successful exploit…
-
Unscored —
Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (D…
-
Unscored —
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. S…
-
Unscored —
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message …
-
Unscored —
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Success…
-
Unscored —
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Re…
-
Unscored —
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Succe…
-
Unscored —
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exp…
-
Unscored —
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer ov…
-
Unscored —CVE-2019-13961 Public exploit
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files…
-
Unscored —
In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image con…
-
Unscored —
In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a…
-
Unscored —
Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 20…
-
Unscored —
OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on…
-
Unscored —
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detec…
-
Unscored —
MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password inf…
-
High 7.2
MA for Windows update addresses weak directory permissions
Privilege escalation vulnerability in McAfee Agent (MA) before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory.
-
Unscored —
Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database acce…
-
Unscored —
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (o…
-
Unscored —
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrat…
-
Unscored —
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection …
-
Unscored —
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrat…
-
Unscored —CVE-2019-13956 Public exploit
Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demo…
-
Unscored —
In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing …
-
Critical 9.8
SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The…
-
Medium 6.1
Gitea XSS Vulnerability
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack ve…
-
Unscored —
The set_ipv6() function in zscan_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflo…
-
Unscored —
The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.x before 3.2.1 has a stack-based buffer overflow via a long and …
-
Unscored —
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers c…
-
Critical 9.8CVE-2019-1010268 Public exploit
Improper Restriction of XML External Entity Reference in ladon
Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: …
-
Unscored —
index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.
-
Unscored —
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a…
-
Unscored —
SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properl…
-
Unscored —
TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the …
-
High 7.8
Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unis…
-
Medium 6.5
UAA - Login app subject to clickjacking attack
Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.
-
Medium 5.4
Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Serv…