Archive
October 2019
Vulnerabilities first published in this month (UTC), newest first.
17 results · Clear filters · Feed
-
Low 3.1
Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.
-
Low 3.1
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS session…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 2.3
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to s…
-
Low 3.7
SQL Injection and Cross-site Scripting in class-validator
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk …
-
Low 2.4
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Supported versions…
-
Low 2.4
RabbitMQ XSS attack
Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, …
-
Low 3.3
Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin
Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 2.4
IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacke…
-
Low —
Low severity vulnerability that affects eye.js
## Test breaking ### Impact In v1.2.0, tests are broken: all tests are always succeeding. If tests are looking for security vulnerabilities, these were compromised. ### Patches Users should upgrade to `v1.2.1` ### Workarounds Users who don't use eye.js for lo…
-
Low 3.7
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using man…
-
Low 1.6CVE-2019-15166 Public exploit
lmp_print in tcpdump lacks certain boundary checks
lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.
-
Low 3.7
IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in f…
-
Low 3.5
CSV Injection in usage report downloaded from Pivotal Application Manager
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenti…
-
Low 3.3
DingTalk Plugin stores credentials in plain text
Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Low —
Jenkins LDAP Email Plugin shows plain text password in configuration form
Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.