Archive
8 August 2019
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
Unscored —
On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create …
-
Unscored —
Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configur…
-
Unscored —
The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expir…
-
Unscored —
Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers…
-
Unscored —
Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated b…
-
Unscored —
The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.
-
Unscored —
Nespresso Prodigio devices lack Bluetooth connection security.
-
Unscored —
Cognitoys Dino devices allow XSS via the SSID.
-
Unscored —
Cognitoys Dino devices allow profiles_add.html CSRF.
-
Unscored —
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
-
Unscored —
6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
-
Unscored —
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplit…
-
Unscored —
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=adm…
-
Unscored —
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remov…
-
Unscored —
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?pa…
-
Unscored —
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?act…
-
Medium 6.1
Backpack\CRUD for Laravel XSS Vulnerability
The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
-
Unscored —
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/…
-
Unscored —
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-a…
-
Unscored —
On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of e…
-
Unscored —
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet…
-
Unscored —
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet …
-
High 8.5
Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing li…
-
Medium 6.1
Cross-site scripting in Apache Ranger
Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
-
Unscored —
Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have an information l…
-
Unscored —
Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution…
-
Unscored —
Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution…
-
Unscored —
Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an information leak vulnerability. A…
-
Unscored —
Huawei smart phones Emily-L29C with versions of 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10), 8.1.0.154(C461), 8.1…
-
Medium 6.4
TIBCO API Exchange Processes OAuth Incorrectly
The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential es…
-
Unscored —
An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.…
-
Unscored —
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated de…
-
Medium 6.1
Cross-Site Scripting (XSS) in Verdaccio
verdaccio before 3.12.0 allows XSS.
-
Unscored —
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transactio…
-
Unscored —
NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
-
Unscored —
A Server Side Request Forgery (SSRF) vulnerability in go-camo up to version 1.1.4 allows a remote attacker to perform H…
-
Unscored —CVE-2019-14221 Public exploit
1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.
-
Unscored —
Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id para…
-
Unscored —
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without…
-
Medium 4.8
Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability
A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is du…