Archive
2 October 2019
Vulnerabilities first published on this day (UTC), newest first.
75 results · Feed
-
High 8.2
Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace…
-
High 8.2
Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace…
-
High 8.6
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Denial of Service Vulnerability
A vulnerability in the FTP inspection engine of Cisco Adaptive Security (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vu…
-
Unscored —
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in J…
-
Unscored —
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
-
Unscored —
JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, lea…
-
Unscored —
UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing…
-
Unscored —
In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the …
-
Unscored —
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to g…
-
Unscored —
JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very …
-
Unscored —
JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.
-
Unscored —
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on t…
-
Unscored —
An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The i…
-
Unscored —
JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.
-
Unscored —
In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.
-
Medium 4.8
Potential to access user credentials from the log files when debug logging enabled
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
-
Medium 6.1
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due…
-
Medium 6.5CVE-2019-12630 EPSS 66%
Cisco Security Manager Java Deserialization Vulnerability
A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied cont…
-
Unscored —
JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability.
-
Unscored —
In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management cra…
-
Unscored —
This module allows display of a site's content in AMP format. The module doesn't sufficiently check access on unpublish…
-
Critical 9.8
CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to exe…
-
High 8.8
An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, ve…
-
Critical 9.9
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file…
-
Unscored —CVE-2019-16116 Public exploit
EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file…
-
Unscored —CVE-2019-13025 Public exploit
Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Valid…
-
Medium 5.3
IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used …
-
High 7.1
IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attack…
-
Medium 6.1
IBM Security Directory Server 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…
-
High 7.4
IBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks, using an open redirect a…
-
High 7.5
IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to br…
-
Medium 6.1
Cross-site Scripting in Eclipse Mojarra
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
-
Unscored —CVE-2019-17080 Public exploit
mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by …
-
Unscored —
SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation.
-
Unscored —
SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF.