Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
95 results · Clear filters · Feed
-
Unscored —CVE-2019-12889 Public exploit
An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to onl…
-
Critical 9.8CVE-2019-15224 Public exploit
rest-client Gem Contains Malicious Code
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
-
Unscored —CVE-2019-13069 Public exploit
extenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege Escalation to SYSTEM. The…
-
Unscored —
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
-
Unscored —CVE-2019-15120 Public exploit
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
-
Unscored —CVE-2019-15104 Public exploit
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/New…
-
Unscored —CVE-2019-15105 Public exploit
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability i…
-
Unscored —
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password require…
-
Critical 9.8
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…
KEV Mar 25, 2022 -
Unscored —CVE-2019-15084 Public exploit
Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result,…
-
Unscored —
LibreLogo global-event script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreL…
-
Unscored —
An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel …
-
Unscored —CVE-2019-15081 Public exploit
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing f…
-
Unscored —CVE-2019-1218 Public exploit
Outlook iOS Spoofing Vulnerability
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successf…
-
Medium 6.7
Windows Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls. An attacker who successfully exploited this vulnerability could potentially set certain items to run at a higher level and thereby elevat…
-
Medium 5.5CVE-2019-1153 Public exploit
Microsoft Graphics Component Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To ex…
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
High 7.9CVE-2019-1170 Public exploit
Windows NTFS Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. T…
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
Medium 5.5CVE-2019-1148 Public exploit
Microsoft Graphics Component Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To ex…
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
High 8.8
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install …
-
High 7.6CVE-2019-9506 Public exploit
Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can dec…
-
Unscored —CVE-2019-15053 Public exploit
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=fa…
-
Unscored —
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
-
High 7.5
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…
-
High 7.5
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…
-
Unscored —
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can…
-
Unscored —CVE-2018-20966 Public exploit
The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
-
Unscored —
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: D…
-
Critical 9.8
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…
KEV Mar 7, 2022 -
Unscored —
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: T…
-
Unscored —CVE-2017-18486 Public exploit
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogi…
-
Unscored —CVE-2019-14804 Public exploit
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template…
-
Unscored —
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This …
-
Critical 9.8
SQL Injection in Django
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgre…
-
Unscored —CVE-2019-14221 Public exploit
1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.
-
Unscored —
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without…