Skip to content
OpenAdvisories

Archive

18 July 2019

Vulnerabilities first published on this day (UTC), newest first.

← June 2019 2019 / July /18 August 2019 →
  1. 160
  2. 268
  3. 397
  4. 448
  5. 561
  6. 619
  7. 74
  8. 833
  9. 937
  10. 1090
  11. 1184
  12. 1211
  13. 132
  14. 146
  15. 1585
  16. 1636
  17. 1768
  18. 1860
  19. 1950
  20. 20 
  21. 2113
  22. 2236
  23. 23244
  24. 2422
  25. 2569
  26. 2636
  27. 2720
  28. 2820
  29. 2987
  30. 3095
  31. 3162
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.1
    CVE-2019-1010261

    Gitea XSS Vulnerability

    Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack ve…

    Gitea Gitea code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  • Medium 6.5
    CVE-2019-3794

    UAA - Login app subject to clickjacking attack

    Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.

    Cloud Foundry UAA Release (OSS)
  • Medium 5.4
    CVE-2019-3734

    Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Serv…

    DELL EMC Unity
  • Medium 5.4
    CVE-2019-13647

    Firefly III vulnerable to image-based stored XSS

    Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must hav…

    grumpydictator/firefly-iii Packagist
  • Medium 5.4
    CVE-2019-13646

    Firefly III vulnerable to reflected cross-site scripting

    Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

    grumpydictator/firefly-iii Packagist
  • Medium 5.4
    CVE-2019-13645

    Firefly III vulnerable to stored XSS

    Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have …

    grumpydictator/firefly-iii Packagist
  • Medium 5.4
    CVE-2019-13644

    Firefly III vulnerable to stored XSS

    Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted t…

    grumpydictator/firefly-iii Packagist