Archive
18 July 2019
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Unscored —
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r an…
-
High 7.5
Secret insertion into debug log in Docker
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a sta…
-
Unscored —
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versi…
-
Unscored —
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploita…
-
Unscored —
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versi…
-
Unscored —
The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigat…
-
High 7.5
b3log Wide unauthenticated file access
b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then …
-
Unscored —
moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of …
-
Unscored —
Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An atta…
-
High 8.8CVE-2019-1010054 Public exploit
Dolibarr Cross Site Request Forgery (CSRF)
Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encrypta…
-
Unscored —
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that …
-
Unscored —
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that …
-
Unscored —
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that …
-
Unscored —
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
-
Unscored —
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
-
Medium 5.4
Firefly III vulnerable to image-based stored XSS
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must hav…
-
Medium 5.4
Firefly III vulnerable to reflected cross-site scripting
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
-
Medium 5.4
Firefly III vulnerable to stored XSS
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have …
-
Medium 5.4
Firefly III vulnerable to stored XSS
Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted t…
-
Unscored —
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source …