Archive
23 August 2019
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open …
-
Unscored —CVE-2019-15092 Public exploit
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection i…
-
Medium 5.5
Improper input validation in Apache Santuario XML Security for Java
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread…
-
Unscored —
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8…
-
Unscored —
Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below ma…
-
Unscored —
An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain p…
-
Unscored —
Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated atta…
-
Unscored —
Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementati…
-
Unscored —
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, Auto…
-
Unscored —
Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a use…
-
Unscored —
DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a use…
-
Unscored —
The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.
-
Critical 9.8
SQL Injection in SimpleSAMLphp
The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
-
Unscored —
Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.
-
High 8.6
A path traversal vulnerability has been identified in Verastream Host Integrator
Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.
-
Unscored —
Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistl…
-
Unscored —
Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause …
-
Critical 9.8
PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface
A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior t…
-
Unscored —
Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 a…
-
Unscored —
Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. …
-
Unscored —
Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have …
-
Critical 9.8
Prototype Pollution in deeply
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
-
Critical 9.8
Prototype Pollution in set-value
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
-
Critical 9.8
Prototype Pollution in mixin-deep
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
-
High 8.8
Open Redirect in httpie
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL point…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/…
-
Unscored —
There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.
-
Unscored —
comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.
-
Unscored —
jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.
-
Unscored —
Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.
-
Unscored —
Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.
-
Unscored —
Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply remov…
-
Unscored —
Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2…
-
Unscored —
The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from v…
-
Unscored —
The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.…