Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
120 results · Clear filters · Feed
-
Unscored —CVE-2019-14462 Public exploit
An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS…
-
Unscored —CVE-2019-12750 Public exploit
Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition…
-
Unscored —CVE-2019-7616 Public exploit
Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration fo…
-
Unscored —CVE-2019-5454 Public exploit
SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query …
-
High 7.5
Deserialization of untrusted data in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in …
-
Unscored —
The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.…
-
Critical 9.8
Moby Docker cp broken with debian containers
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
-
Unscored —CVE-2019-13498 Public exploit
One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-…
-
Unscored —CVE-2019-14267 Public exploit
PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mish…
-
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Mar 15, 2022 -
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Re…
-
Unscored —
An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its mem…
-
Unscored —CVE-2019-1020010 Public exploit
Misskey before 10.102.4 allows hijacking a user's token.
-
Unscored —
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a ca…
-
Unscored —CVE-2019-14328 Public exploit
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
-
High 7.5
Pallets Werkzeug vulnerable to Path Traversal
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
-
Unscored —
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to…
-
Unscored —
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a UR…
-
Unscored —CVE-2019-14280 Public exploit
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images wh…
-
Unscored —CVE-2019-5603 Public exploit
In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE be…
-
Critical 9.8
XML external entity injection in Terracotta Quartz Scheduler
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
-
Critical 9.1CVE-2019-10744 Public exploit
Prototype Pollution in lodash
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
-
Unscored —CVE-2019-1010174 Public exploit
CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load…
-
Unscored —CVE-2019-2861 Public exploit
Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported vers…
-
Unscored —CVE-2019-9816 Public exploit
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, a…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing ce…
-
Unscored —
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when proc…
-
Unscored —CVE-2019-11705 Public exploit
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processi…
-
Unscored —CVE-2019-11706 Public exploit
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when pr…
-
High 8.8
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…
KEV May 23, 2022 -
Critical 10.0
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…
KEV May 23, 2022