Archive
30 October 2019
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Unscored —
The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic l…
-
Unscored —
The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allow…
-
Unscored —
A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web…
-
Unscored —
Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.
-
Unscored —
Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified imp…
-
Unscored —
drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3…
-
Unscored —
A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permis…
-
Unscored —
An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. There is …
-
Unscored —
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name…
-
Unscored —
European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain Ex…
-
Unscored —
European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign …
-
Critical 9.8
SQL Injection in medoo
columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
-
Unscored —
The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
-
Medium 4.8
Apache Airflow vulnerable to XSS and local file disclosure
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET …
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX me…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with .…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function o…
-
Unscored —
In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (applicati…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associate…
-
Unscored —
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and We…
-
Unscored —
xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes …
-
Unscored —
In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper…
-
Unscored —
A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary…
-
Unscored —
Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.…
-
Unscored —
Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achiev…
-
Unscored —
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board gro…
-
Unscored —
Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.…
-
Unscored —
RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denia…
-
Medium 5.9
An oversight while backporting a feature leads to an assertion failure in buffer.c:420
While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distribu…
-
High 7.5
Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages fr…
-
Unscored —
Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauth…
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.