Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
-
Medium 5.4
Cross-Site Scripting in min-http-server
Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
Medium 5.4
Cross-Site Scripting in http-file-server
Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
Unscored —
SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 a…
-
High 8.1
Missing Encryption of Sensitive Data in yarn
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
-
Unscored —
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by …
-
Unscored —
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
-
Unscored —
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default …
-
Unscored —
libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
-
Unscored —
DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
-
Unscored —
J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
-
Unscored —
libopenmpt before 0.3.13 allows a crash with malformed MED files.
-
Unscored —
libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.
-
Unscored —
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permiss…
-
Unscored —
An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8…
-
Unscored —
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploita…
-
Unscored —
Windows builds with insecure path defaults
OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir con…
-
Unscored —
Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote …
-
High 7.1
A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, exclud…
-
High 8.3
Openstack ironic-inspector has SQL injection vulnerability in node_cache
A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfilter…
-
High 7.5
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacke…
-
High 7.1
Improper Access Control in novajoin
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
-
Low 3.1
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, exc…
-
Medium 6.5
A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned ta…
-
Critical 9.8
Rancher Recreates Default User With Known Password Despite Deletion
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial …
-
Unscored —
The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).
-
Unscored —
cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).
-
Unscored —
cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).
-
Unscored —
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
-
Unscored —
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
-
Unscored —
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
-
Unscored —
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
-
Unscored —
cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).
-
Unscored —
In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).
-
Unscored —
cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).
-
Unscored —
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
-
Unscored —
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
-
Unscored —
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
-
Unscored —
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
-
Unscored —
cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).