Archive
23 September 2019
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
Medium 4.9
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects t…
-
High 8.1
Use of Insufficiently Random Values in Apereo CAS
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
-
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
Unscored —
A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Deni…
-
High 8.1
High severity vulnerability that affects generator-jhipster
## Generated code uses repository configuration that downloads over HTTP instead of HTTPS ### Impact Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at bui…
-
High 8.4
Volume Services is vulnerable to an LDAP injection attack
Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating…
-
Unscored —
An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. A…
-
High 7.8
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabiliti…
-
Low 3.3
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabiliti…
-
High 7.8
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabiliti…
-
Medium 6.5
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password t…
-
Medium 6.1
Cross-site Scripting in Apache JSPWiki
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the vic…
-
Medium 6.1
Cross-site scripting in Apache JSPWiki
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some…
-
High 7.5
Home Assistant information disclosure vulnerability
Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.
-
Critical 9.8
Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly
The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
-
Unscored —
Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the s…
-
Medium 6.1
Cross-site scripting in Apache JSPWiki
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some …
-
Medium 6.1CVE-2019-10089 Public exploit
Cross-site scripting in Apache JSPWiki
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get so…
-
Medium 6.1
Cross-site scripting in Apache JSPWiki
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and…
-
Unscored —
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_js…
-
Unscored —
An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. An attacker may be able to trigger a…
-
High 8.1
All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to in…
-
Unscored —
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.
-
Unscored —
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
-
Unscored —
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an …
-
Unscored —
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=…
-
Unscored —
In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a craf…
-
Unscored —
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
-
Unscored —
ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.
-
Unscored —
ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.
-
Unscored —
ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
-
Unscored —
ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c.
-
Unscored —
ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image.
-
Unscored —
ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c.
-
Unscored —
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive informatio…
-
Unscored —
kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.
-
Unscored —
Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in li…
-
Unscored —
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
-
Unscored —
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
-
Unscored —
Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs p…