Archive
5 August 2019
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Unscored —
eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorizat…
-
Unscored —
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted mu…
-
Unscored —
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in…
-
Unscored —
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction…
-
Unscored —
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset accou…
-
Unscored —
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name f…
-
Low 3.3
Improper Input Validation in Firefly III
Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
-
Unscored —
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability n…
-
Unscored —
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin w…
-
Unscored —
An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens …
-
Unscored —
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sendin…
-
Unscored —
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard fea…
-
Unscored —
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly for…
-
Unscored —
SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead t…
-
Unscored —
Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow…
-
Unscored —
A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. …
-
Unscored —
Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.
-
Unscored —
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject …
-
High 7.1
Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attac…
-
Medium 6.3
CF CLI writes the client id and secret to config file
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as …
-
High 7.3
UAA clients.write vulnerability
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes …
-
Unscored —
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information vi…
-
Medium 4.4
IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token th…
-
Medium 4.3
IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial o…
-
High 8.4
Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, wh…
-
Unscored —
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
-
Unscored —
cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
-
Unscored —
cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
-
Unscored —
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
-
Unscored —
cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165…
-
Unscored —
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
-
Unscored —
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
-
Unscored —
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
-
Unscored —
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
-
Unscored —
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-…
-
Unscored —
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
-
Unscored —
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
-
Unscored —
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
-
Unscored —
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).