Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —CVE-2019-12453 Public exploit
In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.
-
Unscored —
MDaemon Webmail (formerly WorldClient) has CSRF.
-
Unscored —
In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage …
-
Unscored —
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used t…
-
Unscored —
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null …
-
Medium 6.5
Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format
Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack ve…
-
Unscored —
H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.
-
High 7.5
Infinite Loop in scapy
scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.
-
High 8.1
Authentication bypass when using LDAP authentication in MongoDB Enterprise Server
Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
-
Unscored —
ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The imp…
-
Unscored —
Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution wit…
-
Unscored —
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code executi…
-
Medium 6.1
Cross-site scripting in CLEditor
Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim mus…
-
Medium 4.1
System.Management.Automation subject to bypass via script debugging
A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.
-
Unscored —
The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impac…
-
Unscored —
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execu…
-
Unscored —
In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to…
-
Unscored —
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the up…
-
Unscored —
interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a…
-
Unscored —
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Ser…
-
Unscored —
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a…
-
Unscored —
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirect…
-
Unscored —
Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.
-
Unscored —
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/…
-
Unscored —
Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.…
-
Unscored —
In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user…
-
Unscored —
Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.
-
Unscored —CVE-2019-13977 Public exploit
index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=cre…
-
Unscored —
LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.
-
Unscored —
LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted,…
-
Unscored —
LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.
-
Unscored —
OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.
-
Medium 6.1
AntSword RCE and XSS via code injection
In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.
-
Unscored —
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_conte…
-
Unscored —
Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability. Successful exploitation cou…
-
Unscored —
Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. Successful exploitatio…
-
Unscored —
Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitati…
-
Unscored —
Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. Successful exploit…
-
Unscored —
Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (D…
-
Unscored —
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. S…