Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other fi…
-
Unscored —
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session co…
-
Unscored —
IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buff…
-
Unscored —
zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.
-
Unscored —
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/ma…
-
Unscored —
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/z…
-
Unscored —
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized…
-
Unscored —
zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code E…
-
Unscored —
zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.
-
Unscored —
LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` …
-
High 7.3CVE-2019-10173 EPSS 95%
Deserialization of Untrusted Data and Code Injection in xstream
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML o…
-
Unscored —
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: …
-
Unscored —CVE-2019-14241 EPSS 70%
HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client…
-
Unscored —
WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?fi…
-
Unscored —CVE-2019-1010124 Public exploit
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to…
-
Unscored —
In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to c…
-
Unscored —
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function …
-
Unscored —
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invo…
-
Critical 9.0
A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of …
-
High 7.2
Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet…
-
Unscored —
Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - C…
-
Unscored —
tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Ret…
-
Unscored —
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed De…
-
Unscored —
TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can rea…
-
High 7.2
Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an att…
-
Unscored —
The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are …
-
High 8.2
The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware ver…
-
Unscored —
The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTw…
-
Unscored —
The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), w…
-
High 7.2
A command injection (missing input validation) issue in the IP address field for the logging server in the configuratio…
-
Unscored —
The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cle…
-
Unscored —
Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1,…
-
Unscored —
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can …
-
Unscored —
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirect…
-
Unscored —
Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or P…
-
Unscored —
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading …
-
Unscored —
Lack of check to prevent the buffer length taking negative values can lead to stack overflow. in Snapdragon Auto, Snapd…
-
Unscored —
Debug policy with invalid signature can be loaded when the debug policy functionality is disabled by using the parallel…
-
Unscored —
Improper validation for inputs received from firmware can lead to an out of bound write issue in video driver. in Snapd…
-
Unscored —
Shared memory gets updated with invalid data and may lead to access beyond the allocated memory. in Snapdragon Auto, Sn…