Archive
3 September 2019
Vulnerabilities first published on this day (UTC), newest first.
36 results · Feed
-
Unscored —
Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.
-
Unscored —
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure …
-
Medium 5.3
Path Traversal in statichttpserver
A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders.
-
Unscored —
A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able …
-
High 7.5
Unintended Require in larvitbase-api
An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).
-
High 8.8
OS Command Injection in Nexus Yum Repository Plugin
The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
-
Medium 4.8
A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that …
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior t…
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prio…
-
Medium 5.3
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to ver…
-
Unscored —
An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices. Due to an insufficient implementation of jamming det…
-
Medium 5.6CVE-2019-1125 Public exploit
Windows Kernel Information Disclosure Vulnerability
An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability,…
-
Medium 6.1
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by …
-
Medium 6.4
Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation v…
-
Medium 4.7
Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116…
-
High 7.3
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not pro…
-
High 7.3CVE-2019-14811 Public exploit
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not proper…
-
Medium 6.5
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when…
-
Unscored —
NDrive(1.2.2).sys in Naver Cloud Explorer has a stack-based buffer overflow, which allows attackers to cause a denial o…
-
Unscored —
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an…
-
Unscored —
The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
-
Unscored —
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
-
Unscored —
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
-
Unscored —
The JobCareer theme before 2.5.1 for WordPress has stored XSS.
-
Unscored —
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
-
Unscored —
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, …
-
Unscored —
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp…
-
Unscored —
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
-
Unscored —
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
-
Unscored —
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run…
-
Unscored —
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request…
-
Unscored —
Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.
-
Unscored —
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthentic…
-
Unscored —
FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
-
Unscored —
FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is misha…
-
Unscored —
FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.