Archive
24 October 2019
Vulnerabilities first published on this day (UTC), newest first.
39 results · Feed
-
Unscored —CVE-2019-17596 Public exploit
Panic on invalid DSA public keys in crypto/dsa
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
-
Unscored —CVE-2019-18418 Public exploit
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests b…
-
Unscored —
A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to in…
-
Unscored —
Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.
-
Unscored —
Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can res…
-
Unscored —
Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.
-
Unscored —
Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation…
-
Unscored —
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Success…
-
Unscored —
Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulne…
-
Unscored —
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated…
-
Unscored —
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful expl…
-
Unscored —
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.…
-
Critical 9.8
Craft CMS possibility of brute force attempts
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
-
Unscored —
A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397)…
-
Unscored —
Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of…
-
Unscored —
admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code exec…
-
High 7.8
An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service i…
-
High 7.1
An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service i…
-
Unscored —
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5).
-
Unscored —
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5).
-
Unscored —
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of …
-
Unscored —
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5).
-
Unscored —
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5).
-
Unscored —
A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the …
-
Unscored —
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption …
-
Unscored —
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption …
-
High 7.8
Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource
The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into…
-
Unscored —
An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable h…
-
Unscored —
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption …
-
Unscored —
A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker …
-
Unscored —
archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free …
-
Unscored —
tonyy dormsystem through 1.3 allows DOM XSS.
-
Medium 5.4
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Medium 4.0
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a …
-
Medium 5.4
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable …
-
Medium 5.3
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensiti…
-
Critical 9.8
Ignite Realtime Openfire vulnerable to Server Side Request Forgery
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
-
Medium 5.3
Ignite Realtime Openfire directory traversal vulnerability
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
-
Low 3.7
SQL Injection and Cross-site Scripting in class-validator
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk …