Skip to content
OpenAdvisories

Archive

October 2019

Vulnerabilities first published in this month (UTC), newest first.

← September 2019 2019 / October November 2019 →
  1. 147
  2. 275
  3. 353
  4. 432
  5. 58
  6. 615
  7. 756
  8. 878
  9. 9107
  10. 10131
  11. 1151
  12. 129
  13. 136
  14. 1442
  15. 1520
  16. 16243
  17. 17112
  18. 1813
  19. 193
  20. 203
  21. 2136
  22. 2224
  23. 2395
  24. 2439
  25. 2556
  26. 26 
  27. 27 
  28. 2856
  29. 2956
  30. 3034
  31. 3173
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2019-18394 Public exploit Scanner template EPSS 32%

    Ignite Realtime Openfire vulnerable to Server Side Request Forgery

    A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

    org.igniterealtime.openfire:parent Maven
  • Critical 9.0
    CVE-2019-17625 Public exploit

    Rambox RCE Vulnerability

    There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft…

    Rambox npm
  • Critical 9.9
    CVE-2019-10760 Public exploit

    Sandbox Breakout / Arbitrary Code Execution in safer-eval

    safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.

    snyk safer-eval safer-eval npm
  • Critical 9.8
    CVE-2019-17195 Public exploit EPSS 11%

    Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT

    Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

    com.nimbusds:nimbus-jose-jwt Maven
  • Critical 9.8
    CVE-2019-16278 Exploited Public exploit Scanner template EPSS 99%

    Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…

    KEV Nov 7, 2024
  • Critical 9.8
    CVE-2019-17495 Public exploit

    Cross-site scripting in Swagger-UI

    A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other w…

    swagger-ui org.webjars:swagger-ui io.springfox:springfox-swagger-ui org.webjars.npm:swagger-ui npm Maven
  • Critical 9.8
    CVE-2019-16891 Public exploit EPSS 45%

    Liferay Portal Allows RCE via Deserialization of a JSON Payload

    Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

    com.liferay.portal:release.portal.bom Maven
  • Critical 9.8
    CVE-2018-14881 Public exploit

    The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_REST…

    tcpdump tcpdump tcpdump Debian Ubuntu Alpine