Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
146 results · Clear filters · Feed
-
Medium 6.8
Cisco IOS XR Software Border Gateway Protocol Denial of Service Vulnerability
A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to incor…
-
Medium 5.3
Cisco Unified Communications Domain Manager Restricted Shell Escape Vulnerability
A vulnerability in the CLI of Cisco Unified Communications Domain Manager (Cisco Unified CDM) Software could allow an authenticated, local attacker to escape the restricted shell. The vulnerability is due to insufficient input validation of shell commands. An…
-
Medium 5.1
Denial of Service in mem
Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abus…
-
Medium 5.9CVE-2019-5630 Public exploit
Rapid7 Nexpose/InsightVM Security Console CSRF
A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-f…
-
Medium 6.1
infusionsoft-php-sdk reflected Cross-site Scripting
novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution
-
Medium 6.1
-
Medium 6.8
Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior t…
-
Medium 4.3
It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with …
-
Medium 6.1
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 5.3
IBM Daeja ViewONE Professional, Standard & Virtual 5.0 through 5.0.5 could allow an unauthorized user to download serve…
-
Medium 6.3
IBM Tivoli Storage Manager Server (IBM Spectrum Protect 7.1 and 8.1) could allow a local user to replace existing datab…
-
Medium 5.3
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due …
-
Medium 6.5
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a f…
-
Medium 5.1
IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive informat…
-
Medium 5.4
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This…
-
Medium 4.9
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain hi…
-
Medium 6.2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 is vulnerable to a denial of ser…
-
Medium 5.4
A Cross-Frame Scripting vulnerability in IBM InfoSphere Information Server 11.3, 11.5, and 11.7 can allow an attacker t…
-
Medium 4.0
IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-…
-
Medium 5.9
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected c…
-
Medium 6.7
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user …
-
Medium 6.4
IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LD…
-
Medium 6.1
mxGraph vulnerable to cross-site scripting in color field
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/graph…
-
Medium 5.3
Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. …
-
Medium 5.3
libxslt Type Confusion vulnerability that affects Nokogiri
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
-
Medium 5.3
Uninitialized read in Nokogiri gem
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any…