Archive
15 October 2019
Vulnerabilities first published on this day (UTC), newest first.
20 results · Feed
-
Unscored —CVE-2019-13392 Scanner template
A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remot…
-
Unscored —
An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controlle…
-
Unscored —
qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction…
-
Unscored —
In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication…
-
Unscored —CVE-2019-17602 EPSS 81%
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is…
-
Unscored —
In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during a…
-
Unscored —
In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authent…
-
Unscored —
In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to ach…
-
Unscored —
In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, a…
-
Unscored —
In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is…
-
Unscored —
The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during …
-
Medium 5.0
Keycloak Unauthenticated Access
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry…
-
Medium 6.1
Haml vulnerable to cross-site scripting
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attr…
-
Critical 9.9CVE-2019-10760 Public exploit
Sandbox Breakout / Arbitrary Code Execution in safer-eval
safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
-
Critical 9.9
Sandbox Breakout / Arbitrary Code Execution in safer-eval
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
-
Unscored —
In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authenti…
-
Unscored —
Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is …
-
Unscored —
Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user …
-
Critical 9.8
Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
-
Medium 6.1
Dolibarr ERP and CRM HTML Injection
There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.