Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Medium 5.3
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used i…
-
Medium 6.3
IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by impr…
-
Medium 4.0
IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user o…
-
Medium 5.4
IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Medium 6.1
IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim…
-
Medium 4.8
IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to…
-
Unscored —
An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered …
-
Unscored —
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-…
-
Unscored —
Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/setti…
-
Unscored —
Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.
-
Unscored —
contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.
-
Unscored —
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the ad…
-
Unscored —
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/…
-
Unscored —
CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal.
-
Unscored —
CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/devic…
-
Unscored —
eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.
-
Unscored —
eBrigade before 5.0 has evenements.php cid SQL Injection.
-
Unscored —
SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.
-
Unscored —
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send …
-
Unscored —
eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.
-
Unscored —
In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fai…
-
Unscored —
In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails t…
-
Critical 9.8
Improper Input Validation in simple_form
Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.
-
High 8.8
phpBB Cross-Site Request Forgery (CSRF)
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthentic…
-
Unscored —
The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to si…
-
Unscored —
Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related …
-
Unscored —CVE-2019-16941 Public exploit
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feat…
-
Medium 6.1
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the s…
-
Unscored —
Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think…
-
Unscored —
Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid v…
-
High 8.1
Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerabili…
-
High 8.4
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability…
-
Critical 9.8
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts …
-
High 8.2
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM…
-
Unscored —
An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on t…
-
Critical 9.8
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-b…
KEV Mar 3, 2022 -
Unscored —
Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc,…
-
Medium 5.4
Dolibarr stored Cross-site Scripting in an Email Template section
Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)
-
Medium 5.4
Dolibarr Cross-site Scripting in a User Profile in a Signature section
Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
-
Medium 5.4
Dolibarr Cross-site Scripting in a User Note section
Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.