Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to …
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS …
-
High 7.8CVE-2019-0053 Public exploit
Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of envir…
-
High 7.5
SRX Series: srxpfe process crash while JSF/UTM module parses specific HTTP packets
The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a regular TCP packet which causes the processor to crash. This issue affects all SRX Series platforms…
-
Medium 6.5
Junos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface.
A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me…
-
Medium 5.8
EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail
On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority. This rule is meant for reserved multicast addresses 224.0.0.x, but incorrectly matches on 224.x.x.…
-
High 7.5
Junos OS: RPD process crashes when BGP peer restarts
On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a certain sequence of BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol d…
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authent…
-
Unscored —
WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash…
-
Medium 6.1
Gitea XSS Vulnerability in Repository Description
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and…
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow …
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authent…
-
Unscored —
pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in…
-
Unscored —
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flo…
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow …
-
Unscored —
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flo…
-
Unscored —
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authent…
-
Unscored —
The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (g…
-
Unscored —
Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs b…
-
Unscored —CVE-2019-13029 Public exploit
Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9…
-
Unscored —
Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.
-
Unscored —
Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control.
-
Unscored —
Intersystems Cache 2017.2.2.865.0 allows XXE.
-
Unscored —
Intersystems Cache 2017.2.2.865.0 allows XSS.
-
Critical 9.3
ACM SQL Injection
A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Ma…
-
Unscored —
An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is config…
-
Medium 5.9
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficientl…
-
High 7.2CVE-2019-10192 EPSS 26%
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x …
-
High 7.2CVE-2019-10193 EPSS 23%
A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x…
-
Medium 4.6
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3…
-
Unscored —
SUNNET WMPro v5.0 and v5.1 has OS Command Injection
The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.
-
Critical 9.1
eClass platform allows user to download arbitrary files without authentication
Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.
-
Unscored —CVE-2019-12525 EPSS 24%
An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authe…
-
Medium 6.5
UAA SQL Identity Zone Vulnerability
Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private i…
-
Unscored —CVE-2019-12527 EPSS 50%
An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid…
-
Unscored —
An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 …
-
Unscored —
XSS exists in Ping Identity Agentless Integration Kit before 1.5.
-
Unscored —
D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.
-
Unscored —
D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr par…
-
Unscored —
D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metachara…