Archive
October 2019
Vulnerabilities first published in this month (UTC), newest first.
1,573 results · Feed
-
Unscored —
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.
-
Unscored —
ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.
-
Unscored —
yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have othe…
-
Unscored —
On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each…
-
Medium 6.1
Pimcore XSS Vulnerability
Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements.
-
Unscored —
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.…
-
Unscored —
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in …
-
Unscored —
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated opti…
-
Unscored —
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitr…
-
Critical 9.1
python-docutils allows insecure usage of temporary files
python-docutils allows insecure usage of temporary files
-
Unscored —
overkill has buffer overflow via long player names that can corrupt data on the server machine
-
Unscored —
burn allows file names to escape via mishandled quotation marks
-
Unscored —
The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection …
-
Unscored —
In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was …
-
Unscored —
In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.
-
Unscored —
-
Unscored —
A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker co…
-
Unscored —
In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the correspondi…
-
Unscored —
In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters …
-
Unscored —
In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
-
Unscored —
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
-
Medium 5.3
Cross-site scripting in Jupyter Notebook
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
-
Unscored —
In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration…
-
Unscored —
JetBrains MPS before 2019.2.2 exposed listening ports to the network.
-
Unscored —
JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code exe…
-
Unscored —
In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installi…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation wher…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileg…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging r…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_…
-
Unscored —
In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with …
-
Unscored —
The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic l…
-
Unscored —
The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allow…
-
Unscored —
A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web…
-
Unscored —
Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.
-
Unscored —
Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified imp…
-
Unscored —
drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3…
-
Unscored —
A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permis…