Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Medium 4.9
kubelet-started container uid changes to root after first restart or if image is already pulled to the node
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will…
-
High 7.4
HG100 contains an Uncontrolled Resource Consumption vulnerability
The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated reso…
-
Unscored —
Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
-
Unscored —
Advan VD-1 has a vulnerability that allows remote arbitrary APK installation
A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.
-
Unscored —
Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or …
-
Unscored —
A vulnerability of remote credential disclosure was discovered in Advan VD-1
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSetting…
-
Critical 10.0
SmartHome application has a broken access control vulnerability in its Web API Server
A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via …
-
Critical 10.0CVE-2019-11061 Public exploit
HG100 has a broken access control vulnerability in its Web API Server
A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 b…
-
Unscored —
Advan VD-1 allows users to download arbitrary files
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.
-
High 7.5CVE-2019-12402 EPSS 16%
Denial of Service in Apache Commons Compress
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an …
-
Unscored —
nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fai…
-
Unscored —
There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary…
-
Unscored —
Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash t…
-
Unscored —
Various Lexmark products have a Buffer Overflow (issue 3 of 3).
-
Unscored —
Various Lexmark products have a Buffer Overflow (issue 2 of 3).
-
Unscored —
Various Lexmark products have an Integer Overflow.
-
Unscored —
Various Lexmark products have CSRF.
-
Unscored —
The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.
-
Critical 9.1
OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly vi…
-
High 7.8
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-…
KEV Nov 3, 2021 -
Unscored —
An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type…
-
Unscored —
An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and par…
-
Unscored —
An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.d…
-
Unscored —
An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to ac…
-
Unscored —
An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { f…
-
Unscored —
A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be trigg…
-
High 8.6
Cisco NX-OS Software IPv6 Denial of Service Vulnerability
A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an unexpected restart of the netstack process on an affected device. The vulnerability is due to improper validation of IPv6 traffi…
-
High 7.7
Cisco NX-OS Software Remote Management Memory Leak Denial of Service Vulnerability
A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated, remote attacker to cause a VSH process to fail to delete upon termination. This can lead to a build-up of VSH processes that overtime can depl…
-
High 8.6
Cisco NX-OS Software Cisco Fabric Services over IP Denial of Service Vulnerability
A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause process crashes, which can result in a denial of service (DoS) condition on an affected system. The vulnerability is due to…
-
High 7.7
Cisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service Vulnerability
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application on an affected device to restart unexpectedly. …
-
Critical 10.0
Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability
A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on the managed Cisco IOS XE device. The vulnerability is due to an improper check performed by t…
-
Unscored —
The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to e…
-
Unscored —
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead …
-
Unscored —
LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Al…
-
Unscored —
CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level acc…
-
Unscored —
Various Lexmark products have Incorrect Access Control.
-
Unscored —
Various Lexmark products have Incorrect Access Control (issue 2 of 2).
-
Unscored —
Various Lexmark products have Incorrect Access Control (issue 1 of 2).
-
Unscored —
In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source c…
-
Unscored —
In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.