Skip to content
OpenAdvisories

Archive

14 September 2019

Vulnerabilities first published on this day (UTC), newest first.

← August 2019 2019 / September /14 October 2019 →
  1. 1 
  2. 21
  3. 336
  4. 437
  5. 559
  6. 655
  7. 7 
  8. 822
  9. 997
  10. 1057
  11. 11139
  12. 1242
  13. 1350
  14. 1411
  15. 158
  16. 1671
  17. 1772
  18. 1844
  19. 1918
  20. 2077
  21. 2117
  22. 226
  23. 2340
  24. 2430
  25. 25104
  26. 2668
  27. 27311
  28. 283
  29. 291
  30. 3064
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 8.8
    CVE-2019-16317

    Pimcore RCE via PHAR upload

    In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var…

    pimcore/pimcore Packagist
  • High 8.8
    CVE-2019-16318

    Pimcore Unrestricted Upload of File with Dangerous Type

    In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2…

    pimcore/pimcore Packagist
  • Unscored —
    CVE-2019-16307

    A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetin…

  • Unscored —
    CVE-2019-16294 Public exploit

    SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode c…

  • Unscored —
    CVE-2019-16309

    FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.

  • Unscored —
    CVE-2019-16310

    NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.

  • Unscored —
    CVE-2019-16311

    NIUSHOP V1.11 has CSRF via search_info to index.php.

  • Unscored —
    CVE-2019-16312

    s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.

  • Unscored —
    CVE-2019-16313 Scanner template EPSS 46%

    ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.

  • Unscored —
    CVE-2019-16314 EPSS 39%

    Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.

  • Unscored —
    CVE-2019-16305

    In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup…