Archive
14 August 2019
Vulnerabilities first published on this day (UTC), newest first.
176 results · Feed
-
Medium 5.5CVE-2019-1148 Public exploit
Microsoft Graphics Component Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To ex…
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
High 8.8
Chakra Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the contex…
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
High 7.5
MS XML Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the user’s system. To exploit th…
-
Medium 5.8
Windows Hyper-V Denial of Service Vulnerability
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host …
-
Medium 5.8
Windows Hyper-V Denial of Service Vulnerability
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host …
-
Medium 5.8
Windows Hyper-V Denial of Service Vulnerability
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host …
-
Medium 5.8
Windows Denial of Service Vulnerability
A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, an attacker would have to log o…
-
Medium 5.8
Windows Hyper-V Denial of Service Vulnerability
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host …
-
Unscored —
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via …
-
Unscored —
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request …
-
Unscored —
The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-a…
-
Unscored —
stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information…
-
Unscored —
The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authenti…
-
Unscored —
eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to st…
-
Unscored —
eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Me…
-
Unscored —
eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain…
-
Unscored —
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/a…
-
Unscored —
eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, …
-
Unscored —
eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point …
-
Critical 9.8
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If t…
-
Unscored —CVE-2018-19386 Scanner template
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component,…
-
Unscored —
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security v…
-
Unscored —
Forms Steps provides an UI to create form workflows using form modes. It creates quick and configurable multisteps form…
-
Unscored —
The External Link Filter module provides an input filter that replaces external links by a local link that redirects to…
-
Unscored —
This module improves the Drupal login page with the new features and layout. The module doesn't sufficiently filter inp…
-
High 7.6CVE-2019-9506 Public exploit
Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can dec…
-
Medium 4.1
Privilege Escalation vulnerability in FRP 5.x earlier than 5.1.0.209
Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated privileges.
-
High 7.1
MWG UI: Cross-Frame Scripting vulnerability
Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header.
-
Medium 4.3
MWG Proxy: Cross-Frame Scripting vulnerability
Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.
-
High 8.1
Improper Verification of Cryptographic Signature in keycloak
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attac…
-
Medium 4.6
Improper Input Validation and Cross-Site Request Forgery in Keycloak
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
-
Unscored —CVE-2019-15053 Public exploit
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=fa…
-
Unscored —
A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4…
-
Unscored —
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
-
Unscored —
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export acti…
-
Unscored —
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
-
Unscored —
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
-
Unscored —
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.