Archive
19 July 2019
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
Unscored —
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?pag…
-
Unscored —
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and la…
-
Unscored —
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versi…
-
Unscored —
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informati…
-
Unscored —
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versi…
-
Unscored —
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress.…
-
Unscored —
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web a…
-
Unscored —
Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.2, 1.4.1, 1.4.0, and 1.2.4.2 could allow unauthorized remot…
-
Unscored —
A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to…
-
High 8.1
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…
KEV Jan 10, 2022 -
Medium 6.7
exacqVision Server Unquoted Service Path
ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This…
-
Unscored —
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO p…
-
Unscored —
In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2, Tegra bootloader contains a vulnerability in nvtboot in whi…
-
Unscored —
dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.
-
Unscored —
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the …
-
Unscored —
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app …
-
Unscored —CVE-2019-12453 Public exploit
In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.
-
Unscored —
MDaemon Webmail (formerly WorldClient) has CSRF.
-
Unscored —
In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage …
-
Unscored —
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used t…
-
Unscored —
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null …
-
Medium 6.5
Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format
Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack ve…
-
Unscored —
H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.
-
High 7.5
Infinite Loop in scapy
scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.
-
High 8.1
Authentication bypass when using LDAP authentication in MongoDB Enterprise Server
Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
-
Unscored —
ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The imp…
-
Unscored —
Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution wit…
-
Unscored —
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code executi…
-
Medium 6.1
Cross-site scripting in CLEditor
Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim mus…
-
Medium 4.1
System.Management.Automation subject to bypass via script debugging
A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.
-
Unscored —
The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impac…
-
Unscored —
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execu…
-
Unscored —
In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to…
-
Unscored —
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the up…
-
Unscored —
interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a…
-
Unscored —
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Ser…
-
Unscored —
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a…
-
Unscored —
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirect…
-
Unscored —
Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.
-
Unscored —
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/…