Archive
14 October 2019
Vulnerabilities first published on this day (UTC), newest first.
42 results · Feed
-
Unscored —
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in n…
-
Unscored —
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurse…
-
Unscored —
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
-
High 7.5
Regular Expression Denial of Service in csv-parse
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.
-
Medium 6.8
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, …
-
Unscored —CVE-2019-14737 Public exploit
Ubisoft Uplay 92.0.0.6280 has Insecure Permissions.
-
High 7.5
Dell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. Dell ImageAssist stores some…
-
Unscored —CVE-2017-14948 Public exploit
Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The im…
-
Unscored —
In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes inpu…
-
Unscored —
AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary a…
-
Unscored —
An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary cou…
-
Unscored —
An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could al…
-
Unscored —
OX App Suite 7.10.1 and 7.10.2 allows SSRF.
-
Unscored —
OX App Suite through 7.10.2 has Insecure Permissions.
-
Unscored —
OX App Suite 7.10.1 and 7.10.2 allows XSS.
-
Critical 9.8
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…
KEV Nov 7, 2024 -
Unscored —
A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of se…
-
Unscored —
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many…
-
Unscored —
ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an …
-
Unscored —
tonyy dormsystem through 1.3 allows SQL Injection in admin.php.
-
Unscored —
There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can …
-
Unscored —
SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
-
High 7.3
Ansible leaks sensitive information to logs when told not to
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log o…
-
Medium 5.2
Wildfly Authorization Misconfiguration
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
-
Unscored —CVE-2019-9745 Public exploit
CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This to…
-
Unscored —
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote atta…
-
Unscored —CVE-2019-17574 Scanner template
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partiall…
-
Medium 4.1
IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into…
-
Unscored —
An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability i…
-
Unscored —
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.
-
Unscored —
parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because …
-
Unscored —
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 …
-
Unscored —
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified ot…
-
Unscored —
ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
-
Unscored —
FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_…
-
Unscored —CVE-2019-17543 EPSS 10%
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applicat…
-
Unscored —
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp v…
-
Critical 9.8
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exc…
-
Unscored —
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.