Archive
24 September 2019
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE…
-
High 7.5
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially cra…
-
Unscored —
In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Are…
-
Critical 9.8
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widg…
KEV Nov 3, 2021 -
Unscored —
File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Except…
-
Unscored —CVE-2019-14220 Public exploit
An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs An…
-
Medium 6.1
Joomla! XSS in Default Templates
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
-
Unscored —
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-…
-
Unscored —
ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext.
-
Unscored —
ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowi…
-
Unscored —
An issue was discovered in Suricata 4.1.4. By sending multiple fragmented IPv4 packets, the function Defrag4Reassemble …
-
Unscored —
An issue was discovered in Suricata 4.1.4. By sending multiple IPv4 packets that have invalid IPv4Options, the function…
-
Unscored —
An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the pa…
-
Unscored —
On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection metho…
-
Unscored —
On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) c…
-
Unscored —
RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an atta…
-
Medium 6.1
Devise Token Auth vulnerable to Cross-site Scripting
An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript paylo…
-
Unscored —
SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow
-
Medium 6.7
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file vers…
-
Unscored —CVE-2019-16383 Public exploit
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 …
-
Unscored —
In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\IS…
-
Unscored —
In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\IS…
-
Unscored —
In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe all…
-
Medium 6.2
IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a …
-
Medium 4.3
IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attac…
-
Unscored —
CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (…
-
Unscored —
In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while ha…
-
Unscored —
An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v…
-
Unscored —
pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could al…
-
Medium 6.1
Cross-Site Scripting in dompurify
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.