Archive
23 October 2019
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Unscored —
Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remot…
-
Unscored —
XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 f…
-
Unscored —
XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka…
-
Unscored —
An issue was discovered on AVStar PE204 3.10.70 IP camera devices. A denial of service can occur on open TCP port 23456…
-
Unscored —
An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramaster_T…
-
Unscored —
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read …
-
Unscored —
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via th…
-
Unscored —
Creative Cloud Desktop Application version 4.6.1 and earlier versions have Security Bypass vulnerability. Successful ex…
-
Unscored —
Adobe Acrobat and Reader versions 2019.010.20100 and earlier; 2019.010.20099 and earlier versions; 2017.011.30140 and e…
-
Unscored —
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2…
-
Unscored —
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerabili…
-
Unscored —
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After…
-
Medium 5.5
Improper Restriction of XML External Entity Reference in Apache POI
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External E…
-
Unscored —
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an applicatio…
-
Unscored —
This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.0…
-
Unscored —
Nessus versions 8.6.0 and earlier were found to contain a Denial of Service vulnerability due to improper validation of…
-
Unscored —
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).
-
Unscored —
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).
-
Unscored —
An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.
-
Unscored —
Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint.
-
Unscored —CVE-2019-9596 Public exploit
Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint.
-
Unscored —
Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
-
Unscored —
In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, le…
-
Unscored —
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service atta…
-
Unscored —
An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability al…
-
Unscored —
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to t…
-
Medium 5.4
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection …
-
Unscored —
In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable com…
-
Medium 6.1
hexo-admin plugin for Node.js XSS Vulnerability
The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.
-
Unscored —
The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x befo…
-
Unscored —
The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1…
-
Unscored —
The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
-
Unscored —
The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7…
-
Unscored —
The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before…
-
Unscored —
The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.…
-
Unscored —
The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x …
-
Unscored —
The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.
-
Unscored —
The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1…
-
Unscored —
The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before…
-
Unscored —
The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1…