Skip to content
OpenAdvisories

Archive

25 July 2019

Vulnerabilities first published on this day (UTC), newest first.

← June 2019 2019 / July /25 August 2019 →
  1. 160
  2. 268
  3. 397
  4. 448
  5. 561
  6. 619
  7. 74
  8. 833
  9. 937
  10. 1090
  11. 1184
  12. 1211
  13. 132
  14. 146
  15. 1585
  16. 1636
  17. 1768
  18. 1860
  19. 1950
  20. 20 
  21. 2113
  22. 2236
  23. 23244
  24. 2422
  25. 2569
  26. 2636
  27. 2720
  28. 2820
  29. 2987
  30. 3095
  31. 3162
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2019-10744 Public exploit

    Prototype Pollution in lodash

    Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

    snyk lodash js-jquery lodash Debian Azure Linux npm RubyGems
  • Critical 9.8
    CVE-2018-11779

    Deserialization of Untrusted Data in Apache Storm

    In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

    Apache Storm org.apache.storm:storm-kafka org.apache.storm:storm-kafka-client Maven
  • Critical 9.8
    CVE-2019-9885

    eClass platform contains a SQL injection vulnerability

    eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.

    BroadLearning eclass
  • Critical 9.8
    CVE-2019-9884

    eClass platform contains a Broken Access Control vulnerability

    eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.

    BroadLearning eclass