Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, e…
-
Unscored —
Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Inf…
-
Unscored —
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affec…
-
Unscored —CVE-2019-1010287 Scanner template
Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to e…
-
Unscored —
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, …
-
Unscored —
Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) a…
-
Unscored —
In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could …
-
Unscored —
An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious…
-
Unscored —
An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious…
-
Unscored —CVE-2019-13493 Public exploit
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged …
-
Unscored —
SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string…
-
Unscored —
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP…
-
Unscored —CVE-2019-13585 EPSS 15%
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP requ…
-
Unscored —
In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device…
-
Unscored —
CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and …
-
Unscored —
CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 2018…
-
Unscored —
In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka …
-
Medium —
XSS in TinyMCE
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media eleme…
-
Unscored —CVE-2019-13346 Public exploit
In MyT 1.5.1, the User[username] parameter has XSS.
-
Unscored —CVE-2019-12475 Public exploit
In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
-
Unscored —CVE-2019-13403 Public exploit
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, lead…
-
Unscored —
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPre…
-
High 7.5
Cross-Site Request Forgery in Jenkins
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
-
Medium 4.3
Missing Authorization in Jenkins
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
-
Medium 6.5CVE-2019-10352 EPSS 10%
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended di…
-
Unscored —
Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a…
-
Medium 4.3
IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could …
-
Medium 5.4
IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Medium 6.1
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Medium 5.3
IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount…
-
Medium 5.4
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Medium 4.0
IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could …
-
Medium 5.3
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a…
-
High 7.5
Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage
The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.
-
Unscored —
Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unat…
-
High 7.8
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proc…
KEV Dec 10, 2021 -
Unscored —CVE-2019-9849 Public exploit
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote…
-
Unscored —CVE-2019-9848 EPSS 29%
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document ev…
-
Unscored —
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pr…
-
Unscored —
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characte…