Archive
4 October 2019
Vulnerabilities first published on this day (UTC), newest first.
32 results · Feed
-
Unscored —
Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22…
-
Unscored —
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. A…
-
High 7.5
DOS attack in Pillow when processing specially crafted image files
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
-
Unscored —
Foxit Reader before 9.7 allows an Access Violation and crash if insufficient memory exists.
-
Unscored —
Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrat…
-
Unscored —
Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. Th…
-
Unscored —
Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability coul…
-
Unscored —
4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, …
-
Critical 9.8
Sandbox Breakout in realms-shim
Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arb…
-
Unscored —
FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue …
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
Medium 5.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader …
-
High 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.207…
-
High 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0…
-
Unscored —
libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied reallo…
-
Unscored —
HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other produ…
-
Unscored —
joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.
-
Medium 6.1
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability a…
-
Medium 5.6
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauth…
-
Medium 5.3
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The …
-
High 7.5
user/group information can be corrupted across storing in fsimage and reading back from fsimage
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
-
Unscored —
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE…
-
Unscored —
vBulletin through 5.5.4 mishandles custom avatars.
-
Unscored —
vBulletin before 5.5.4 allows clickjacking.
-
Unscored —
vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
-
Unscored —
REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.
-
Critical 9.8
Liferay Portal Allows RCE via Deserialization of a JSON Payload
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.