Archive
13 September 2019
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
Critical 9.8
JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password rese…
-
Critical 10.0
Command Injection in gitlabhook
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
-
High 7.5
Symlink Arbitrary File Overwrite in bower
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
-
Unscored —CVE-2019-11660 Public exploit
Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30,…
-
Unscored —
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requ…
-
Unscored —
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requ…
-
Unscored —
A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated u…
-
Unscored —
Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XS…
-
Unscored —
A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attack…
-
Unscored —
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with adminis…
-
Unscored —
A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration…
-
Unscored —
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no…
-
Unscored —
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should o…
-
Unscored —
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web ap…
-
Unscored —
A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to t…
-
Unscored —
The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS comm…
-
Unscored —
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long …
-
Unscored —
On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the dev…
-
Unscored —
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item par…
-
Medium 6.9
McAfee Total Protection - Free Antivirus Trial: DLL Search Order Hijacking vulnerability
DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with adm…
-
Unscored —
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' proc…
-
Unscored —
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' proc…
-
Medium 6.5
phpMyAdmin Cross-Site Request Forgery (CSRF)
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
-
Unscored —
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing	…
-
Unscored —
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_ma…
-
Unscored —
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality av…
-
Unscored —
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-a…
-
Unscored —
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
-
Unscored —
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
-
Unscored —
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
-
Unscored —
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page …
-
Unscored —
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
-
Unscored —
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
-
Unscored —
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
-
Unscored —
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
-
Unscored —
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
-
Unscored —
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
-
Unscored —
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
-
Unscored —
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
-
Unscored —
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.