Archive
15 August 2019
Vulnerabilities first published on this day (UTC), newest first.
56 results · Feed
-
Unscored —
An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of …
-
Unscored —CVE-2019-15084 Public exploit
Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result,…
-
Unscored —
Insufficient URL encoding flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python …
-
Unscored —
LibreLogo global-event script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreL…
-
Unscored —
Insufficient url validation allowing LibreLogo script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-ins…
-
Unscored —CVE-2019-10081 EPSS 14%
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwr…
-
Unscored —
The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of serv…
-
Unscored —
A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escal…
-
Unscored —
A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers t…
-
Unscored —
Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwr…
-
Unscored —
Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attack…
-
Unscored —
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forg…
-
Unscored —
In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may t…
-
Unscored —
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.
-
Unscored —
In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may t…
-
Unscored —CVE-2019-13510 EPSS 12%
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A malicio…
-
Unscored —
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A …
-
Unscored —
Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an …
-
Unscored —
In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory …
-
Unscored —
In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Rem…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of…
-
Unscored —
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a mal…
-
Unscored —
In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_da…
-
Unscored —
Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.
-
Medium 5.5
A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local a…
-
Unscored —
CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links field…
-
Unscored —
Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions.
-
Unscored —
Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.
-
Unscored —
Prospecta Master Data Online (MDO) 2.0 has Stored XSS.
-
Unscored —
The read_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a den…
-
Unscored —
Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any accoun…
-
Unscored —CVE-2019-12854 EPSS 12%
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with …
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which re…
-
Unscored —
The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel att…
-
Unscored —
An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel …
-
Unscored —
Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that …
-
Unscored —
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
-
Unscored —
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.…
-
Unscored —
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPre…