Archive
9 October 2019
Vulnerabilities first published on this day (UTC), newest first.
107 results · Feed
-
Unscored —
In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the h…
-
Unscored —
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchP…
-
Unscored —
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id pa…
-
Unscored —
PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.
-
Unscored —
A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthe…
-
Unscored —
tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn_get_string error: Resource te…
-
Medium 6.5
koji hub allows arbitrary upload destinations
Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.
-
Unscored —
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the us…
-
Unscored —
Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control.
-
Unscored —
NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software perfor…
-
Unscored —CVE-2019-5700 Public exploit
NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra software contains a vulnerability in the bootloader, where it…
-
High 8.8
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document i…
-
High 8.8
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory …
-
High 8.8
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory …
-
High 8.8
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document i…
-
High 7.5
An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially craf…
-
High 7.5
An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. A specially crafted PDF …
-
Unscored —
A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution i…
-
Unscored —
A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easi…
-
Unscored —
A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to su…
-
Unscored —
A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that results in passwords for 3rd part…
-
Unscored —
The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When…
-
Unscored —
A security vulnerability exists in the Zingbox Inspector versions 1.280 and earlier, where authentication is not requir…
-
Unscored —
An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that…
-
Unscored —
A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to su…
-
Unscored —
A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that allows for the Inspector to be su…
-
Unscored —
A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authen…
-
Unscored —
In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are pr…
-
Medium 4.3
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic use…
-
Medium 5.6
SBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.
An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions pri…
-
High 7.8
Junos OS: EX2300, EX3400 Series: Veriexec signature checking not enforced in specific versions of Junos OS
Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versions of Junos OS, affecting specific EX Series platforms, the Veriexec subsystem will fail to initiali…
-
Medium 5.5
Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure.
A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue only affects NFX150 Ser…
-
High 7.5
Junos OS: SRX Series: Denial of Service vulnerability in srxpfe related to PIM
A vulnerability in the srxpfe process on Protocol Independent Multicast (PIM) enabled SRX series devices may lead to crash of the srxpfe process and an FPC reboot while processing (PIM) messages. Sustained receipt of these packets may lead to an extended deni…
-
Medium 6.6
Junos OS: PKI key pairs are exported with insecure file permissions
The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS…
-
Medium 6.8
Junos OS: SRX Series: An attacker may be able to perform Man-in-the-Middle (MitM) attacks during app-id signature updates.
An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update client of Juniper Networks Junos OS allows an attacker to perform Man-in-the-Middle (MitM) attacks which may compromise the integrity and confid…
-
High 7.5
Junos OS: The routing protocol process (rpd) may crash and generate core files upon receipt of specific valid BGP states from a peered host.
A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific commands from a peered BGP host and having those BGP states delivered to the vulnerable device. This issue …
-
High 7.5
Junos OS: SRX5000 Series: flowd process crash due to receipt of specific TCP packet
On SRX5000 Series devices, if 'set security zones security-zone <zone> tcp-rst' is configured, the flowd process may crash when a specific TCP packet is received by the device and triggers a new session. The process restarts automatically. However, receipt of…
-
High 7.5
Junos OS: SRX Series: An attacker may cause flowd to crash by sending certain valid SIP traffic to a device with SIP ALG enabled.
A vulnerability in the SIP ALG packet processing service of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific types of valid SIP traffic to the device. In this case, the flowd process crashes and…
-
High 7.8
Junos OS: SRX Series: A weakness in the Veriexec subsystem may allow privilege escalation.
A vulnerability in the Veriexec subsystem of Juniper Networks Junos OS allowing an attacker to fully compromise the host system. A local authenticated user can elevate privileges to gain full control of the system even if they are specifically denied access t…
-
Medium 5.3
Junos OS: MX Series: Denial of Service vulnerability in MS-PIC component on MS-MIC or MS-MPC
On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on MS-MIC or MS-MPC. By continuously sending a crafted SIP packet, an attacker can repeatedly bring down MS-PIC on MS-MIC/MS-MPC causing a sust…