Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
95 results · Clear filters · Feed
-
Unscored —CVE-2019-15811 Public exploit
In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
-
Unscored —
There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An …
-
Critical 10.0CVE-2019-11061 Public exploit
HG100 has a broken access control vulnerability in its Web API Server
A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 b…
-
High 7.8
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-…
KEV Nov 3, 2021 -
Unscored —CVE-2015-9357 Public exploit
The akismet plugin before 3.1.5 for WordPress has XSS.
-
Unscored —
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful expl…
-
Medium 4.3CVE-2019-13237 Public exploit
Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workp…
-
Medium 6.1CVE-2019-13236 Public exploit
XSS issues in the management interface
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
-
Medium 6.1CVE-2019-13235 Public exploit
XSS in login form
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
-
Medium 6.1CVE-2019-13234 Public exploit
XSS in search engine
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
-
Unscored —
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialis…
-
High 7.1
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to informa…
-
Unscored —CVE-2019-15501 Public exploit
Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
-
Unscored —CVE-2019-15092 Public exploit
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection i…
-
Medium 6.1CVE-2019-15477 Public exploit
Cross-site Scripting in Jooby
Jooby before 1.6.4 has XSS via the default error handler.
-
Unscored —CVE-2019-15514 Public exploit
The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that t…
-
Unscored —CVE-2019-13139 Public exploit
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build"…
-
High 7.5CVE-2019-14751 Public exploit
NLTK Vulnerable To Path Traversal
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
-
High 7.5CVE-2019-9153 Public exploit
Message Signature Bypass in openpgp
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.
-
Unscored —
Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allo…
-
Unscored —
The ebook-download plugin before 1.2 for WordPress has directory traversal.
-
Critical 9.8
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User accoun…
-
High 7.2
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on th…
-
Critical 9.8
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token …
-
High 8.8
Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected …
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —CVE-2019-8014 Public exploit
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —CVE-2019-15233 Public exploit
The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of…
-
Unscored —CVE-2019-14430 Public exploit
plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.