Archive
23 August 2019
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or Jav…
-
Unscored —
The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from versio…
-
Unscored —
The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0…
-
Unscored —
The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote att…
-
Unscored —
Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote …
-
Unscored —
The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames vi…
-
Unscored —
The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export fil…
-
Unscored —
The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before ver…
-
Unscored —
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the u…
-
Unscored —
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user c…
-
Unscored —
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes o…
-
Medium 6.1
Cross-Site Scripting in selectize-plugin-a11y
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
-
Unscored —
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
-
Unscored —
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
-
Unscored —
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
-
Unscored —
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
-
Unscored —
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
-
Medium 6.1
Cross-site Scripting in Ignite Realtime Openfire
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
-
Unscored —
DfE School Experience before v16333-GA has XSS via a teacher training URL.
-
Medium 6.1
Cross-site Scripting in django-js-reverse
django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.
-
Medium 6.1
Cross-site Scripting in Bolt
Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.
-
Medium 6.1
Bolt Cross-site Scripting (XSS) via an image's alt or title field
Bolt before 3.6.10 has XSS via an image's alt or title field.
-
Medium 6.1
Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log
Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.
-
Medium 6.1
Kimai v2 is vulnerable to Cross-Site Scripting (XSS)
Kimai v2 before 1.1 has XSS via a timesheet description.
-
Unscored —
Domoticz 4.10717 has XSS via item.Name.
-
Medium 6.1CVE-2019-15477 Public exploit
Cross-site Scripting in Jooby
Jooby before 1.6.4 has XSS via the default error handler.
-
Unscored —
Former before 4.2.1 has XSS via a checkbox value.
-
Unscored —CVE-2019-15514 Public exploit
The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that t…
-
Unscored —
An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used …
-
Unscored —
In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in cert…
-
Unscored —
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain …
-
Unscored —
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB …
-
Unscored —
drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traff…
-
Unscored —
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute,…
-
Unscored —
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS…
-
Critical 9.1
Identity Spoofing in libp2p-secio
Affected versions of `libp2p-secio` does not correctly verify that the `PeerId` of `DstPeer` matches the `PeerId` discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability. ## Recommendation Update to version 0.9.0 or la…
-
Medium 6.5
Denial of Service in rgb2hex
All versions of `rgb2hex` are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value. ## Recommendation Update to version 0.1.6 or later.