30 September 2019

64 results · Feed

• Medium 5.3
  CVE-2019-4280

  IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used i…

  IBM Sterling File Gateway
  Sep 30, 2019
• Medium 6.3
  CVE-2019-4304

  IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by impr…

  IBM WebSphere Application Server
  Sep 30, 2019
• Medium 4.0
  CVE-2019-4112

  IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user o…

  IBM WebSphere Extreme Scale
  Sep 30, 2019
• Medium 5.4
  CVE-2019-4115

  IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to emb…

  IBM WebSphere Extreme Scale
  Sep 30, 2019
• Medium 6.1
  CVE-2019-4109

  IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim…

  IBM WebSphere Extreme Scale
  Sep 30, 2019
• Medium 4.8
  CVE-2019-4106

  IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to…

  IBM WebSphere Extreme Scale
  Sep 30, 2019
• Unscored —
  CVE-2019-16683

  An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered …

  Sep 30, 2019
• Unscored —
  CVE-2019-16932 Scanner template EPSS 39%

  A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-…

  Sep 30, 2019
• Unscored —
  CVE-2019-17046

  Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/setti…

  Sep 30, 2019
• Unscored —
  CVE-2019-17045

  Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.

  Sep 30, 2019
• Unscored —
  CVE-2019-17040

  contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.

  rsyslog rsyslog Debian Alpine
  Sep 30, 2019
• Unscored —
  CVE-2019-16997 Scanner template EPSS 48%

  In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the ad…

  Sep 30, 2019
• Unscored —
  CVE-2019-16996 Scanner template EPSS 12%

  In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/…

  Sep 30, 2019
• Unscored —
  CVE-2017-18636

  CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal.

  Sep 30, 2019
• Unscored —
  CVE-2019-16999

  CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/devic…

  Sep 30, 2019
• Unscored —
  CVE-2019-16745

  eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.

  Sep 30, 2019
• Unscored —
  CVE-2019-16744

  eBrigade before 5.0 has evenements.php cid SQL Injection.

  Sep 30, 2019
• Unscored —
  CVE-2019-14752

  SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.

  Sep 30, 2019
• Unscored —
  CVE-2019-16414

  A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send …

  Sep 30, 2019
• Unscored —
  CVE-2019-16743

  eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.

  Sep 30, 2019
• Unscored —
  CVE-2019-16995

  In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fai…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Sep 30, 2019
• Unscored —
  CVE-2019-16994

  In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails t…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Sep 30, 2019
• Critical 9.8
  CVE-2019-16676

  Improper Input Validation in simple_form

  Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.

  simple_form ruby-simple-form Ubuntu RubyGems
  Sep 30, 2019
• High 8.8
  CVE-2019-16993

  phpBB Cross-Site Request Forgery (CSRF)

  In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthentic…

  phpbb/phpbb phpbb3 Ubuntu Packagist
  Sep 30, 2019