Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Medium 6.1
Status Board vulnerable to Cross-Site Scripting before v1.1.82
Status Board 1.1.81 has reflected XSS via dashboard.ts.
-
Unscored —
Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
-
Critical 9.8
Several Ricoh printers have multiple buffer overflows parsing LPD packets, which allow an attacker to cause a denial of…
-
Unscored —
CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management …
-
High 7.5
Arbitrary file overwrite in tar-rs
An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.
-
Unscored —
Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an att…
-
High 7.5
Uncontrolled recursion in trust-dns-proto
An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.
-
High 7.5
Uncontrolled recursion in rust-yaml
An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.
-
Medium 6.5
Uninitialized memory exposure in claxon
An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.
-
Unscored —
FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.
-
Unscored —
GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input…
-
Unscored —
Pvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers/register_handler.php.
-
Critical 9.8
Spoon Library as used in Fork CMS allows PHP object injection
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object.
-
Medium 5.3
Headers containing newline characters can split messages in hyper
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
-
Medium 5.9
Source code is downloaded over cleartext HTTP in portaudio
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
-
Medium 4.8
HTTPS MitM vulnerability due to lack of hostname verification
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
-
High 8.1
Improper Certificate Validation in openssl
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
-
Medium 6.1
laracom Cross-site Scripting
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
-
Unscored —
rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of servi…
-
Unscored —
Raml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update.
-
Medium 6.1
Cross-Site Scripting in cyberchef
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
-
Medium 6.1
Cross-Site Scripting in status-board
Status Board 1.1.81 has reflected XSS via logic.ts.
-
Unscored —
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information di…
-
Unscored —
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, trigg…
-
Unscored —
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially we…
-
Unscored —
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open …
-
Unscored —CVE-2019-15092 Public exploit
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection i…
-
Medium 5.5
Improper input validation in Apache Santuario XML Security for Java
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread…
-
Unscored —
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8…
-
Unscored —
Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below ma…
-
Unscored —
An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain p…
-
Unscored —
Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated atta…
-
Unscored —
Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementati…
-
Unscored —
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, Auto…
-
Unscored —
Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a use…
-
Unscored —
DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a use…
-
Unscored —
The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.
-
Critical 9.8
SQL Injection in SimpleSAMLphp
The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
-
Unscored —
Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.
-
High 8.6
A path traversal vulnerability has been identified in Verastream Host Integrator
Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.