Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Unscored —
Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistl…
-
Unscored —
Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause …
-
Critical 9.8
PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface
A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior t…
-
Unscored —
Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 a…
-
Unscored —
Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. …
-
Unscored —
Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have …
-
Critical 9.8
Prototype Pollution in deeply
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
-
Critical 9.8
Prototype Pollution in set-value
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
-
Critical 9.8
Prototype Pollution in mixin-deep
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
-
High 8.8
Open Redirect in httpie
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL point…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (expl…
-
Unscored —
GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/…
-
Unscored —
There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.
-
Unscored —
comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.
-
Unscored —
jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.
-
Unscored —
Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.
-
Unscored —
Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.
-
Unscored —
Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply remov…
-
Unscored —
Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2…
-
Unscored —
The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from v…
-
Unscored —
The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.…
-
Unscored —
The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or Jav…
-
Unscored —
The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from versio…
-
Unscored —
The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0…
-
Unscored —
The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote att…
-
Unscored —
Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote …
-
Unscored —
The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames vi…
-
Unscored —
The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export fil…
-
Unscored —
The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before ver…
-
Unscored —
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the u…
-
Unscored —
Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user c…
-
Unscored —
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes o…
-
Medium 6.1
Cross-Site Scripting in selectize-plugin-a11y
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
-
Unscored —
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
-
Unscored —
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
-
Unscored —
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.