Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information dis…
-
Critical 9.8
An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object po…
-
Critical 9.8
An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 f…
-
Unscored —
The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer o…
-
Unscored —
Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device cras…
-
Unscored —
Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information o…
-
Unscored —
Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function afte…
-
Unscored —
VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.
-
Medium 5.3
Cisco HyperFlex Software Counter Value Injection Vulnerability
A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to inject arbitrary values on an affected device. The vulnerability is due to insufficient authentication for the statistics colle…
-
Medium 6.5
Cisco HyperFlex Software Cross-Frame Scripting Vulnerability
A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An …
-
Unscored —
An issue was discovered in the secure portal in Publisure 2.1.2. Because SQL queries are not well sanitized, there are …
-
Unscored —
An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and…
-
Unscored —
An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, o…
-
Unscored —
This module allows you to attach tabular data to an entity. There is insufficient access checking for users with the ab…
-
Medium 5.0
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.…
-
Unscored —
This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's sett…
-
Unscored —
A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition i…
-
Unscored —CVE-2019-16399 Public exploit
Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to acc…
-
High 8.8
Authorization Bypass Through User-Controlled Key in Bagisto
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.
-
Unscored —
Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server…
-
Unscored —
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
-
Unscored —
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A us…
-
Unscored —
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
-
Unscored —
GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.
-
Unscored —
GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source…
-
Unscored —
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers wit…
-
Unscored —
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other…
-
Unscored —
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.
-
Unscored —
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 char…
-
Unscored —CVE-2019-16394 Public exploit
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on …
-
Unscored —
A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmwa…
-
Unscored —
A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause …
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial R…
-
Unscored —
An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 …
-
Unscored —
CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware version…
-
Unscored —
A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (fi…
-
Unscored —
A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could …
-
High 7.5
A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (…
-
Medium 6.5
A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versio…
-
Unscored —
A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions…