Archive
18 September 2019
Vulnerabilities first published on this day (UTC), newest first.
44 results · Feed
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, wh…
-
Unscored —
If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, s…
-
Medium 6.5
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating t…
-
High 8.1
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability all…
-
Medium 6.5
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A mal…
-
Medium 6.5
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabil…
-
Medium 6.5
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnera…
-
Critical 9.9
TIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service Vulnerable To Remote Code Execution
The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution …
-
Critical 10.0
TIBCO Enterprise Runtime for R Server Exposes Remote Code Execution
The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an unauthenticated user to bypass access controls and r…
-
Unscored —
Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9…
-
Unscored —
Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.3…
-
Unscored —
VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201…
-
Unscored —
Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40…
-
Unscored —
Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, …
-
Unscored —
In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of…
-
Unscored —
In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of pro…
-
Unscored —
In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper valida…
-
Unscored —
A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.1…
-
Unscored —
In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensi…
-
High 8.8
An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 1…
-
Unscored —
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information dis…
-
Unscored —
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information dis…
-
Critical 9.8
An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object po…
-
Critical 9.8
An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 f…
-
Unscored —
The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer o…
-
Unscored —
Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device cras…
-
Unscored —
Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information o…
-
Unscored —
Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function afte…
-
Unscored —
VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.
-
Medium 5.3
Cisco HyperFlex Software Counter Value Injection Vulnerability
A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to inject arbitrary values on an affected device. The vulnerability is due to insufficient authentication for the statistics colle…
-
Medium 6.5
Cisco HyperFlex Software Cross-Frame Scripting Vulnerability
A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An …
-
Unscored —
An issue was discovered in the secure portal in Publisure 2.1.2. Because SQL queries are not well sanitized, there are …
-
Unscored —
An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and…
-
Unscored —
An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, o…
-
Unscored —
This module allows you to attach tabular data to an entity. There is insufficient access checking for users with the ab…
-
Medium 5.0
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.…
-
Unscored —
This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's sett…
-
Unscored —
A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition i…
-
Unscored —CVE-2019-16399 Public exploit
Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to acc…
-
High 8.8
Authorization Bypass Through User-Controlled Key in Bagisto
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.