Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/t…
-
Unscored —
HexoEditor v1.1.8-beta is affected by: XSS to code execution.
-
Unscored —
SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The compo…
-
Unscored —
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 al…
-
Unscored —
LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via …
-
Unscored —
_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts v…
-
High 8.8
Mirumee Saleor CSRF Protection Disabled
In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.
-
Critical 9.8
paranoid2 gem Code backdoor
The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
-
Unscored —
An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer overflow on t…
-
Medium 4.3
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly valida…
-
High 7.8
Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL sea…
-
Unscored —
An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0,…
-
Unscored —
Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier all…
-
Unscored —
A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prio…
-
Unscored —
GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in…
-
Unscored —
The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow lo…
-
High 7.8
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the…
-
Unscored —CVE-2019-13027 Public exploit
Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdeta…
-
Unscored —
A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or…
-
Unscored —CVE-2019-13494 Public exploit
nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long va…
-
Unscored —
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13…
-
High 7.8CVE-2019-13574 Public exploit
OS Command Injection in MiniMagick
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
-
Unscored —
A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the resp…
-
Unscored —
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions …
-
Unscored —
A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Po…
-
Unscored —
A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the resp…
Siemens SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7V ICS / OT -
Unscored —CVE-2019-10915 Public exploit
A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration w…
-
Unscored —
ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. Due to path traversal,users ca…
-
High 8.8
Improper Input Validation in Apache Kafka
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vu…
-
Unscored —
Improper authentication in firmware for Intel(R) SSD DC S4500 Series and Intel(R) SSD DC S4600 Series before SCV10150 m…
-
Unscored —
Improper access control in the Intel(R) Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated us…
-
Unscored —
VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process. Patch ESXi650-201907201-UG for t…
-
Unscored —
Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a typ…
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an auth…
-
Medium 5.3
IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used …
-
Medium 4.3
IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file …
-
Medium 5.3
IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application t…
-
Medium 4.4
IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obta…
-
Medium 5.9
IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to info…
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authent…