Archive
29 July 2019
Vulnerabilities first published on this day (UTC), newest first.
87 results · Feed
-
Unscored —CVE-2018-18570 Scanner template
Planon before Live Build 41 has XSS.
-
Unscored —
The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.…
-
Critical 9.8
In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-base…
-
Critical 9.1
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a di…
-
High 7.2
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerabili…
-
High 7.2
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerabili…
-
Medium 5.9
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vu…
-
Unscored —
Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a …
-
Unscored —
Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previ…
-
Unscored —
Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts.…
-
Unscored —
Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. T…
-
Unscored —
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can b…
-
Unscored —
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view d…
-
Unscored —
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successf…
-
Critical 9.8
Moby Docker cp broken with debian containers
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
-
Unscored —
See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying …
-
Unscored —
edx-platform before 2016-06-06 allows CSRF.
-
Unscored —
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
-
High 7.5
Integer Overflow or Wraparound in NATS Server
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated.
-
Unscored —CVE-2019-13498 Public exploit
One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-…
-
Unscored —
edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles …
-
High 8.0
Dolibarr ERP and CRM Code Injection
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An atta…
-
High 8.8
Dolibarr ERP and CRM malicious executable loading
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the …
-
Unscored —
Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of…
-
Unscored —
edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
-
Unscored —
edx-platform before 2015-09-17 allows XSS via a team name.
-
Unscored —
The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online se…
-
Unscored —
HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social N…
-
Unscored —
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_…
-
Unscored —
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones…
-
Unscored —CVE-2019-14267 Public exploit
PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mish…
-
Unscored —
A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely rec…
-
High 7.5
Pterodactyl vulnerable to 2FA Sniffing
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
-
Unscored —
-
Unscored —
-
Unscored —
-
Unscored —
-
Unscored —
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially…
-
Unscored —
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation o…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…