Archive
23 July 2019
Vulnerabilities first published on this day (UTC), newest first.
244 results · Feed
-
Medium 6.1
Cross site scripting attack in ServiceStack Framework
ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vecto…
-
Unscored —
Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is …
-
Unscored —
Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateP…
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tai…
-
Unscored —
The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tit…
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board head conte…
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Extra Contents" …
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" param…
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board hea…
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board title cont…
-
Unscored —
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which …
-
Unscored —
Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function J…
-
Unscored —
Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component…
-
Unscored —
Jsish 2.4.83 2.0483 is affected by: Nullpointer dereference. The impact is: denial of service. The component is: functi…
-
Unscored —
Jsish 2.4.77 2.0477 is affected by: Use After Free. The impact is: denial of service. The component is: function Jsi_Ob…
-
Unscored —
Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function le…
-
Unscored —
GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsig…
-
Unscored —
LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impac…
-
Medium 5.9
kevinsawicki/http-request Missing certificate validation
OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.
-
Unscored —
jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thund…
-
Unscored —
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed e…
-
Unscored —
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has…
-
Unscored —CVE-2019-9816 Public exploit
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, a…
-
Unscored —
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal ima…
-
Unscored —
A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can…
-
Unscored —
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a pote…
-
Unscored —
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results …
-
Unscored —
A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This result…
-
Unscored —
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main …
-
Unscored —
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use,…
-
Unscored —
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could…
-
Unscored —
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a…
-
Unscored —
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when …
-
Unscored —
Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for downloa…
-
Unscored —
If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installe…
-
Unscored —
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently…
-
Unscored —
A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page na…