Archive
9 August 2019
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/s…
-
Unscored —
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET s…
-
Unscored —CVE-2019-12260 EPSS 23%
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vul…
-
Unscored —
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: D…
-
Unscored —
The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter…
-
Unscored —
The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript…
-
Critical 9.8
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…
KEV Mar 7, 2022 -
Medium 4.8
heap-buffer-overflow on exif_scan_thumbnail in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…
-
Medium 4.8
heap-buffer-overflow on exif_process_user_comment in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…
-
Medium 4.3
UAA SCIM Filter XSS
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.
-
Unscored —
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: T…
-
High 7.8
Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-priv…
-
High 7.8
Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-pr…
-
Unscored —
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the …
-
Medium 6.5
OpenStack Nova Server Resource Faults Leak External Exception Details
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in t…
-
Unscored —CVE-2019-12265 EPSS 60%
Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IP…
-
Unscored —
Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security …
-
Unscored —CVE-2019-12259 EPSS 16%
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNE…
-
Unscored —
OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.
-
Unscored —CVE-2019-12256 EPSS 27%
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: S…
-
Unscored —CVE-2019-12257 EPSS 84%
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulne…
-
Unscored —
Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of ho…
-
Unscored —
A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media v…
-
Unscored —
A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s)…
-
Unscored —
A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media ver…
-
Unscored —
A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version…
-
Unscored —
A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software …
-
Unscored —
A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media ver…
-
Unscored —
A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —
A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —
A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5…
-
Unscored —
A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior t…
-
Unscored —
A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —
A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —CVE-2017-18486 Public exploit
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogi…
-
High 8.8
NC Launcher 2 Arbitrary Command Injection Vulnerability
NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target …
-
Medium 6.1
Cross-site scripting in recommender-xblock
Recommender before 2018-07-18 allows XSS.
-
High 7.5
Pallets Werkzeug Insufficient Entropy
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
-
Unscored —
studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
-
Unscored —CVE-2019-14804 Public exploit
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template…