Archive
July 2019
Vulnerabilities first published in this month (UTC), newest first.
1,623 results · Feed
-
Unscored —
Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an …
-
Critical 9.8
Wikimedia MediaWiki Incorrect Access Control vulnerability
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x bef…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.…
-
Medium 5.3
MediaWiki Incorrect Access Control vulnerability
MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.…
-
Unscored —
main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127…
-
Unscored —
An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in …
-
Medium 6.1
paypal/adaptivepayments-sdk-php vulnerable to a reflected XSS
paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution
-
Critical 9.8
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
-
Unscored —
An issue was discovered in Hsycms V1.1. There is a SQL injection vulnerability via a /news/*.html page.
-
Unscored —
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
-
Unscored —
An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST[…
-
Unscored —
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information …
-
Unscored —
A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial o…
-
Unscored —
An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change tha…
-
High 8.8
CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST re…
-
Unscored —
FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an i…
-
Unscored —
Helpy before 2.2.0 allows agents to edit admins.
-
Unscored —
Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflo…
-
Unscored —
Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target devic…
-
Unscored —
Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarificati…
-
Unscored —
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id an…
-
Unscored —
eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HT…
-
Unscored —
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack a…
-
Unscored —
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack a…
-
Unscored —
On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAut…
-
Unscored —
An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privi…
-
Unscored —
An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_author…
-
Unscored —
An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter.
-
Unscored —
An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter.
-
Unscored —
An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter.
-
Unscored —
An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the field_name parameter.
-
High 8.8
Out-of-bounds write in libpng
An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.
-
Unscored —
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting …
-
Critical 9.9
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.
-
Unscored —
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to e…
-
Unscored —
PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.
-
Unscored —
MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.