Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Unscored —
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
-
Unscored —
Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful ex…
-
Unscored —
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppol…
-
Unscored —
Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Succe…
-
High 7.8
Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful …
-
Unscored —
A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20,…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unen…
-
Unscored —
Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), ve…
-
Unscored —
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator S…
-
Critical 9.8CVE-2019-0344 Exploited
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 18…
KEV Sep 30, 2024 -
Unscored —
SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated …
-
Unscored —
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to…
-
Unscored —
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs scrip…
-
Unscored —
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and…
-
Unscored —
When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it…
-
Unscored —
In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligen…
-
Unscored —
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficie…
-
Unscored —
Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1,…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some…
-
Unscored —
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, al…
-
Unscored —
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
-
Unscored —
Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filt…
-
Unscored —
The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows att…
-
Unscored —
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because…
-
Unscored —
handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header.
-
Unscored —
In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.
-
High 8.8
TIBCO LogLogic Log Management Intelligence Multiple Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) Vulnerabilities
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attack…
-
Unscored —
Incorrect parsing validation in net/url
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a no…
-
High 7.5
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…
-
High 7.5CVE-2019-9512 EPSS 83%
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is qu…
-
High 7.5
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…
-
High 7.5CVE-2019-9516 EPSS 57%
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. S…
-
High 7.5CVE-2019-9515 EPSS 87%
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an …
-
High 7.5CVE-2019-9517 EPSS 27%
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer…
-
High 7.5CVE-2019-9518 EPSS 25%
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION …
-
Unscored —
An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in …
-
Unscored —
The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Du…
-
Unscored —
Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vul…
-
Unscored —
PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not p…
-
Unscored —
ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure pe…