Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. i…
-
Unscored —
Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compu…
-
Unscored —
Sanity checks are missing in layout which can lead to SUI Corruption or can lead to Denial of Service in Snapdragon Aut…
-
Unscored —
While rendering the layout background, Error status check is not caught properly and also incorrect status handling is …
-
Unscored —
While sending the rendered surface content to the screen, Error handling is not properly checked results in an unpredic…
-
Unscored —
Access to freed memory can happen while reading from diag driver due to use after free issue in Snapdragon Auto, Snapdr…
-
Unscored —
Failure in taking appropriate action to handle the error case If keypad gpio deactivation fails leads to silent failure…
-
Unscored —
Buffer overflow can occur in display function due to lack of validation of header block size set by user. in Snapdragon…
-
Unscored —
Possible out of bound read occurs while processing beaconing request due to lack of check on action frames received fro…
-
Unscored —
IOMMU page fault while playing h265 video file leads to denial of service issue in Snapdragon Auto, Snapdragon Compute,…
-
Unscored —
Lack of check of data type can lead to subsequent loop-expression potentially go negative and the condition will still …
-
Unscored —
Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through…
-
Critical 9.8
eClass platform contains a SQL injection vulnerability
eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.
-
Critical 9.8
eClass platform contains a Broken Access Control vulnerability
eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.
-
Medium 6.8
DLP Endpoint Windows lock screen bypass with physical access
Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the Windows lock screen via DLPe processes being killed just prior to the screen being locked or when th…
-
Unscored —
In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certai…
-
Unscored —
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData …
-
Medium 4.3
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malici…
-
Medium 4.9
IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security conte…
-
Medium 5.9
IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to im…
-
Medium 5.5
IBM Cloud Private 2.1.0, 3.1.0, and 3.1.1 could disclose highly sensitive information in installer logs that could be u…
-
Medium 4.6
ArcSight Security Management Center stored cross site script issue in version prior to 2.9.1
Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1
-
Unscored —
perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The co…
-
Unscored —
Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component …
-
Unscored —CVE-2019-1010174 Public exploit
CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load…
-
Unscored —
JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of s…
-
Unscored —
yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to c…
-
Unscored —
serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. T…
-
High 7.5
Uncontrolled Resource Consumption in MetadataExtractor
MetadataExtractor 2.1.0 allows stack consumption.
-
Unscored —
This module provides an autocomplete widget for text fields that suggests all existing (previously entered) values for …
-
Unscored —
This module enables you to customize meta tags to help with a site's search engine ranking and improve the display of p…
-
High 7.5
DLP Endpoint log file redirection to arbitrary locations
Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder …
-
Medium 4.6
ArcSight Logger stored cross site script issue in version prior to 6.7.1
Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1
-
Unscored —
Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cau…
-
Unscored —
Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities…
-
Unscored —
Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not…
-
Low 3.9
DLP Endpoint ePO extension vulnerable to XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render i…
-
Low 2.0
DLP Endpoint ePO extension not sanitizing CSV exports
Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via …
-
Unscored —
Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execu…
-
Unscored —
PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Eleme…