Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share applica…
-
Unscored —
An exploitable authentication bypass vulnerability exists in the Bluetooth Low Energy (BLE) authentication module of YI…
-
Critical 9.8
An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11…
-
Unscored —
NVIDIA Tegra contains a vulnerability in BootRom where a user with kernel level privileges can write an arbitrary value…
-
Unscored —
In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12,…
-
High 7.3CVE-2019-14813 EPSS 11%
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly s…
-
Unscored —
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
-
Unscored —
In binder_transaction of binder.c in the Android kernel, there is a possible out of bounds write due to an integer over…
-
Unscored —
In ihevcd_ref_list of ihevcd_ref_list.c in Android 10, there is a possible out of bounds write due to a missing bounds …
-
Unscored —
In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validatio…
-
Unscored —
In ComposeActivityEmailExternal of ComposeActivityEmailExternal.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is …
-
Unscored —
In ippSetValueTag of ipp.c in Android 8.0, 8.1 and 9, there is a possible out of bounds read due to improper input vali…
-
Unscored —
In NDEF_MsgValidate of ndef_utils in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds read due t…
-
Unscored —
In rw_t4t_sm_read_ndef of rw_t4t in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds write due t…
-
Unscored —
In GateKeeper::MintAuthToken of gatekeeper.cpp in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is possible memory corrup…
-
Unscored —
In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion du…
-
Unscored —
In ihevcd_parse_buffering_period_sei of ihevcd_parse_headers.c in Android 8.0, 8.1 and 9, there is a possible out of bo…
-
Unscored —
In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot…
-
Unscored —
In checkAccess of SliceManagerService.java in Android 9, there is a possible permissions check bypass due to incorrect …
-
Unscored —
In SensorManager::assertStateLocked of SensorManager.cpp in Android 7.1.1, 7.1.2, 8.0, 8.1, and 9, there is a possible …
-
Unscored —
In execTransact of Binder.java in Android 7.1.1, 7.1.2, 8.0, 8.1, and 9, there is a possible local execution of arbitra…
-
Unscored —CVE-2019-14222 Public exploit
An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could…
-
Unscored —CVE-2019-14224 Public exploit
An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Sof…
-
Unscored —
FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the servic…
-
Unscored —
The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via …
-
Medium 5.9
Incorrect Resource Transfer Between Spheres in eclipse-wtp
In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred…
-
Unscored —CVE-2019-14339 Public exploit
The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly re…
-
Unscored —
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arb…
-
Unscored —
In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection…
-
High 8.8
Total.js CMS Path Traversal
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .html files that are outside the permitted directory. Also, if a page contains a template directive, then the d…
-
High 8.8
Total.js CMS Unauthorized Access
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not f…
-
Critical 9.9
Total.js CMS RCE Vulnerability
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be eva…
-
Unscored —
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to…
-
Unscored —
In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.
-
Unscored —
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
-
Unscored —
A SQL injection vulnerability in IntraMaps MapControl 8 allows attackers to execute arbitrary SQL commands via the /App…
-
Unscored —
The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file uplo…
-
Unscored —
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.
-
Medium 6.5
An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and ea…
-
High 8.8
A code execution vulnerability exists in Epignosis eFront LMS v5.2.12. A specially crafted web request can cause unsafe…