Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Unscored —
The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of serv…
-
Unscored —
A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escal…
-
Unscored —
A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers t…
-
Unscored —
Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwr…
-
Unscored —
Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attack…
-
Unscored —
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forg…
-
Unscored —
In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may t…
-
Unscored —
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.
-
Unscored —
In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may t…
-
Unscored —CVE-2019-13510 EPSS 12%
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A malicio…
-
Unscored —
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A …
-
Unscored —
Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an …
-
Unscored —
In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory …
-
Unscored —
In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Rem…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of…
-
Unscored —
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a mal…
-
Unscored —
In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_da…
-
Unscored —
Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.
-
Medium 5.5
A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local a…
-
Unscored —
CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links field…
-
Unscored —
Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions.
-
Unscored —
Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.
-
Unscored —
Prospecta Master Data Online (MDO) 2.0 has Stored XSS.
-
Unscored —
The read_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a den…
-
Unscored —
Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any accoun…
-
Unscored —CVE-2019-12854 EPSS 12%
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with …
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which re…
-
Unscored —
The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel att…
-
Unscored —
An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel …
-
Unscored —
Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that …
-
Unscored —
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
-
Unscored —
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.…
-
Unscored —
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPre…
-
Unscored —CVE-2019-14789 Scanner template
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
-
Unscored —
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploita…
-
Unscored —
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGaller…
-
Unscored —
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=upd…
-
Unscored —
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription li…
-
Medium 5.7
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due …