Archive
30 July 2019
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Low 2.3
OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes…
-
Low 3.5
A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authori…
-
Low 3.5
A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized us…
-
High 8.8
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSav…
-
Medium 4.6
Exposure of Sensitive Information to an Unauthorized Actor in ansible
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitutio…
-
Medium 5.0
A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment…
-
High 7.5
Podman Path Traversal Vulnerability leads to arbitrary file read/write
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when …
-
Unscored —CVE-2019-7616 Public exploit
Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration fo…
-
High 7.4
Elastic APM agent for Ruby vulnerable to Improper Certificate Validation
A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'server_ca_cert' setting, the Ruby agent would not properly verify the certificate returned by the APM ser…
-
Medium 5.9
Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing …
-
Unscored —
-
Unscored —
A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or m…
-
Unscored —
Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style t…
-
Unscored —
Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly o…
-
Unscored —
Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting…
-
Unscored —
Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted …
-
Unscored —CVE-2019-5454 Public exploit
SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query …
-
Unscored —
Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.
-
Unscored —
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
-
Medium 5.4
Cross-Site Scripting in min-http-server
Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
Medium 5.4
Cross-Site Scripting in http-file-server
Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
Unscored —
SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 a…
-
High 8.1
Missing Encryption of Sensitive Data in yarn
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
-
Unscored —
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by …
-
Unscored —
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
-
Unscored —
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default …
-
Unscored —
libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
-
Unscored —
DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
-
Unscored —
J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
-
Unscored —
libopenmpt before 0.3.13 allows a crash with malformed MED files.
-
Unscored —
libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.
-
Unscored —
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permiss…
-
Unscored —
An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8…
-
Unscored —
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploita…
-
Unscored —
Windows builds with insecure path defaults
OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir con…
-
Unscored —
Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote …
-
High 7.1
A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, exclud…
-
High 8.3
Openstack ironic-inspector has SQL injection vulnerability in node_cache
A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfilter…
-
High 7.5
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacke…
-
High 7.1
Improper Access Control in novajoin
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.