Archive
October 2019
Vulnerabilities first published in this month (UTC), newest first.
1,573 results · Feed
-
Unscored —
An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. There is …
-
Unscored —
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name…
-
Unscored —
European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain Ex…
-
Unscored —
European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign …
-
Critical 9.8
SQL Injection in medoo
columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
-
Unscored —
The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
-
Medium 4.8
Apache Airflow vulnerable to XSS and local file disclosure
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET …
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX me…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with .…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function o…
-
Unscored —
In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (applicati…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set…
-
Unscored —
ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associate…
-
Unscored —
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and We…
-
Unscored —
xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes …
-
Unscored —
In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper…
-
Unscored —
A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary…
-
Unscored —
Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.…
-
Unscored —
Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achiev…
-
Unscored —
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board gro…
-
Unscored —
Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.…
-
Unscored —
RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denia…
-
Medium 5.9
An oversight while backporting a feature leads to an assertion failure in buffer.c:420
While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distribu…
-
High 7.5
Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages fr…
-
Unscored —
Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauth…
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.
-
Unscored —
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and …
-
Unscored —
rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portma…
-
Unscored —
rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an atta…
-
Unscored —
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers…
-
Unscored —
Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.
-
Unscored —
qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends i…
-
Unscored —
ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.
-
Unscored —
An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default perm…
-
Unscored —
The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the M…
-
Unscored —
The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator…
-
Unscored —
A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER …
-
Unscored —
Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component…
-
Unscored —
Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due…