Skip to content
OpenAdvisories

Archive

29 August 2019

Vulnerabilities first published on this day (UTC), newest first.

← July 2019 2019 / August /29 September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 5.3
    CVE-2019-1968

    Cisco NX-OS Software NX-API Denial of Service Vulnerability

    A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is s…

    Cisco Cisco NX-OS Software 6.0(2)A4(1) Network devices
  • Medium 5.8
    CVE-2019-1969

    Cisco NX-OS Software SNMP Access Control List Configuration Name Bypass Vulnerability

    A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device, even if it is confi…

    Cisco Cisco NX-OS Software Network devices
  • Medium 6.8
    CVE-2019-1977

    Cisco Nexus 9000 Series Fabric Switches ACI Mode Border Leaf Endpoint Learning Vulnerability

    A vulnerability within the Endpoint Learning feature of Cisco Nexus 9000 Series Switches running in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an endpoint devic…

    Cisco Cisco Nexus 9000 Series Fabric Switches in ACI Network devices
  • Medium 6.7
    CVE-2019-4536

    IBM i 7.4 users who have done a Restore User Profile (RSTUSRPRF) on a system which has been configured with Db2 Mirror …

    IBM i
  • Medium 4.0
    CVE-2019-4132

    IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rat…

    IBM Cloud Automation Manager
  • Medium 5.0
    CVE-2019-4133

    IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side (with access to client computer) to …

    IBM Cloud Automation Manager
  • Medium 6.5
    CVE-2019-7307

    Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml

    Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file…

    Ubuntu apport apport Ubuntu
  • Medium 6.5
    CVE-2019-11476

    Integer overflow in whoopsie results in out-of-bounds heap write

    An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-execution in …

    Ubuntu Whoopsie whoopsie Ubuntu
  • Medium 6.1
    CVE-2019-15782

    Cross-Site Scripting in webtorrent

    WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.

    webtorrent npm
  • Medium 4.7
    CVE-2019-11250

    Kubernetes client-go logs authorization headers at debug verbosity levels

    The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic …

    Kubernetes Kubernetes kubeflow-access-management k8s.io/kubernetes Debian Wolfi Go
  • Medium 4.8
    CVE-2019-11249

    kubectl cp allows symlink directory traversal

    The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If…

    Kubernetes Kubernetes k3s Alpine
  • Medium 6.5
    CVE-2019-11248 Scanner template EPSS 75%

    Kubernetes kubelet exposes /debug/pprof info on healthz port

    The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory …

    Kubernetes Kubernetes kubernetes Debian
  • Medium 5.0
    CVE-2019-11247

    Kubernetes kube-apiserver allows access to custom resources via wrong scope

    The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the…

    Kubernetes Kubernetes kubernetes k3s Debian Alpine Go
  • Medium 6.4
    CVE-2019-11246

    kubectl cp allows symlink directory traversal

    The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If…

    Kubernetes Kubernetes
  • Medium 4.9
    CVE-2019-11245

    kubelet-started container uid changes to root after first restart or if image is already pulled to the node

    In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will…

    Kubernetes Kubernetes k8s.io/kubernetes k8s.io/kubernetes/cmd/kubelet Go