Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_js…
-
Unscored —
An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. An attacker may be able to trigger a…
-
High 8.1
All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to in…
-
Unscored —
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.
-
Unscored —
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
-
Unscored —
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an …
-
Unscored —
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=…
-
Unscored —
In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a craf…
-
Unscored —
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
-
Unscored —
ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.
-
Unscored —
ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.
-
Unscored —
ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
-
Unscored —
ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c.
-
Unscored —
ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image.
-
Unscored —
ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c.
-
Unscored —
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive informatio…
-
Unscored —
kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.
-
Unscored —
Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in li…
-
Unscored —
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
-
Unscored —
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
-
Unscored —
Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs p…
-
Unscored —
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is u…
-
Unscored —CVE-2019-16693 Public exploit
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.
-
Unscored —
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is use…
-
Unscored —
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
-
Unscored —
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
-
Unscored —
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
-
Unscored —
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to …
-
Unscored —
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename con…
-
Unscored —CVE-2019-16679 Public exploit
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.
-
Unscored —
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
-
Unscored —
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
-
Medium 5.3
Pagekit User enumeration
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
-
Unscored —
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter.
-
Unscored —
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=…
-
Unscored —
joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.
-
Unscored —
joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of…
-
Unscored —
TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.
-
Unscored —
TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
-
Unscored —
TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.