Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
High 8.8
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios…
KEV Nov 3, 2021 -
Unscored —
In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in…
-
Unscored —CVE-2019-13361 Public exploit
Smanos W100 1.0.0 devices have Insecure Permissions, exploitable by an attacker on the same Wi-Fi network.
-
Unscored —
In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it may dump a core file.…
-
Medium 5.3
An exploitable information disclosure vulnerability exists in the packet-parsing functionality of Blynk-Library v0.6.1.…
-
Unscored —
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
-
Unscored —
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
-
Unscored —
FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_r…
-
Unscored —
Controller/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data. Fixed in version 3.5…
-
Medium 5.9
Divide By Zero in OpenCV.
An issue was discovered in OpenCV 4.1.0. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
-
Unscored —
An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before…
-
Medium 5.3
IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Hos…
-
Medium 5.4
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0…
-
Medium 5.9
IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - …
-
Unscored —
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length …
-
Unscored —
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length fie…
-
Unscored —CVE-2019-10677 Public exploit
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devi…
-
Unscored —
OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
-
Unscored —
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
-
High 7.5
Cisco Webex Teams Logging Feature Command Execution Vulnerability
A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. This vulnerability is due to improper restrictions on software logging features used by the applic…
-
High 7.5
Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability
A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access…
-
Medium 4.3
Cisco Content Security Management Appliance Information Disclosure Vulnerability
A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not corre…
-
Medium 6.1
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an af…
-
Medium 6.7
Cisco Jabber Client Framework for Mac Code Execution Vulnerability
A vulnerability in Cisco Jabber Client Framework (JCF) for Mac Software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to execute arbitrary code on an affected device The vulnerability is due to improper fi…
-
Medium 5.3
Cisco Finesse Request Processing Server-Side Request Forgery Vulnerability
A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on an affected system. The vulnerability exists because the affected system does not properly va…
-
Medium 5.3
Cisco Unified Contact Center Express Request Processing Server-Side Request Forgery Vulnerability
A vulnerability in Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on a targeted system. The vulnerability is due to improper …
-
Unscored —
An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_…
-
Unscored —
An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_…
-
Unscored —
An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstre…
-
Unscored —
An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_…
-
Unscored —
An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_p…
-
Unscored —CVE-2019-12586 Public exploit
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processe…
-
Unscored —CVE-2019-14319 Public exploit
The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, vi…
-
Medium 6.1
Cosenary Instagram-PHP-API contains reflected XSS vulnerability
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() …
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an out-of-bounds rea…
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: t…
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.6. There is a memory leak issue when idr_alloc() fails in genl_r…
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a pf data structure i…