Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an att…
-
Unscored —
The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other u…
-
Unscored —
The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remo…
-
Unscored —
The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows r…
-
Unscored —
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
-
Unscored —
WordPress before 5.2.3 allows XSS in shortcode previews.
-
Unscored —
WordPress before 5.2.3 allows reflected XSS in the dashboard.
-
Unscored —
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can…
-
Unscored —CVE-2019-16223 Public exploit
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
-
Unscored —
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php co…
-
Unscored —
WordPress before 5.2.3 allows XSS in stored comments.
-
Unscored —
In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack throu…
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an…
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change …
-
Unscored —
Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attacke…
-
Unscored —
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd,…
-
Unscored —
TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of …
-
Unscored —
TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is un…
-
Unscored —
Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be…
-
Unscored —
HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, …
-
Unscored —
In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentia…
-
Unscored —
An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.
-
Unscored —
VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.
-
Unscored —
In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and wri…
-
Unscored —
In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XD…
-
Unscored —
In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index…
-
Unscored —
In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server us…
-
Unscored —
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that d…
-
Unscored —
ECDSA remote timing attack
Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is p…
-
Unscored —
Fork Protection
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection w…
-
Unscored —
Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA…
-
Unscored —
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block comma…
-
Unscored —
The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating…
-
Unscored —
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-…
-
Unscored —
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions …
-
Unscored —
In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer resp…
-
Unscored —
SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before vers…
-
Unscored —
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1…
-
Unscored —
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1…
-
Unscored —
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) d…