Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
High 7.8
Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-pr…
-
Unscored —
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the …
-
Medium 6.5
OpenStack Nova Server Resource Faults Leak External Exception Details
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in t…
-
Unscored —CVE-2019-12265 EPSS 60%
Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IP…
-
Unscored —
Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security …
-
Unscored —CVE-2019-12259 EPSS 16%
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNE…
-
Unscored —
OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.
-
Unscored —CVE-2019-12256 EPSS 27%
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: S…
-
Unscored —CVE-2019-12257 EPSS 84%
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulne…
-
Unscored —
Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of ho…
-
Unscored —
A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media v…
-
Unscored —
A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s)…
-
Unscored —
A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media ver…
-
Unscored —
A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version…
-
Unscored —
A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software …
-
Unscored —
A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media ver…
-
Unscored —
A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —
A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —
A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5…
-
Unscored —
A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior t…
-
Unscored —
A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —
A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
-
Unscored —CVE-2017-18486 Public exploit
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogi…
-
High 8.8
NC Launcher 2 Arbitrary Command Injection Vulnerability
NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target …
-
Medium 6.1
Cross-site scripting in recommender-xblock
Recommender before 2018-07-18 allows XSS.
-
High 7.5
Pallets Werkzeug Insufficient Entropy
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
-
Unscored —
studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
-
Unscored —CVE-2019-14804 Public exploit
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template…
-
Unscored —
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
-
Unscored —
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea par…
-
Unscored —
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows …
-
Unscored —
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
-
Unscored —
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory travers…
-
Unscored —
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
-
Unscored —
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/…
-
Unscored —
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.…
-
Unscored —
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This …
-
Unscored —
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newslett…
-
Unscored —
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
-
Critical 9.8
SQL Injection in Django
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgre…