Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
120 results · Clear filters · Feed
-
Unscored —
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other fi…
-
Unscored —CVE-2019-1010124 Public exploit
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to…
-
Unscored —
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote …
-
Unscored —
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informati…
-
Unscored —
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web a…
-
High 8.1
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…
KEV Jan 10, 2022 -
Unscored —CVE-2019-12453 Public exploit
In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.
-
Unscored —CVE-2019-13977 Public exploit
index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=cre…
-
Unscored —CVE-2019-13961 Public exploit
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files…
-
Unscored —CVE-2019-13956 Public exploit
Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demo…
-
Critical 9.8CVE-2019-1010268 Public exploit
Improper Restriction of XML External Entity Reference in ladon
Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: …
-
High 8.8CVE-2019-1010054 Public exploit
Dolibarr Cross Site Request Forgery (CSRF)
Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encrypta…
-
Medium 4.7
Cisco Small Business Series Switches Open Redirect Vulnerability
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the pa…
-
Unscored —CVE-2019-13493 Public exploit
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged …
-
Unscored —
SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string…
-
Unscored —CVE-2019-13346 Public exploit
In MyT 1.5.1, the User[username] parameter has XSS.
-
Unscored —CVE-2019-12475 Public exploit
In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
-
Unscored —CVE-2019-13403 Public exploit
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, lead…
-
High 7.8
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proc…
KEV Dec 10, 2021 -
Unscored —CVE-2019-9849 Public exploit
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote…
-
Unscored —CVE-2019-13623 Public exploit
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive…
-
Critical 9.8
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
KEV Mar 25, 2022 -
High 8.8
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of…
KEV Mar 25, 2022 -
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and uplo…
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login pr…
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a user…
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in…
-
Unscored —CVE-2018-19629 Public exploit
A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allow…
-
Unscored —
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow …
-
Unscored —CVE-2019-1089 Public exploit
An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles a…
-
Unscored —CVE-2019-1096 Public exploit
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'W…
-
Unscored —CVE-2019-1083 Public exploit
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, …
-
Unscored —CVE-2019-1006 Public exploit
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation…
-
High 8.8
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal…
KEV Aug 26, 2026 -
Unscored —
A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an…
-
Unscored —
A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted pa…
-
Unscored —CVE-2019-1010298 Public exploit
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of…
-
Unscored —
_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts v…
-
Unscored —CVE-2019-13027 Public exploit
Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdeta…
-
Unscored —CVE-2019-13494 Public exploit
nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long va…