Archive
October 2019
Vulnerabilities first published in this month (UTC), newest first.
1,573 results · Feed
-
Unscored —
Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO …
-
Medium 5.9
Mercurial Improper Certificate Validation vulnerability
Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.
-
Unscored —
Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerabl…
-
Unscored —CVE-2019-15683 EPSS 19%
TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a5…
-
Unscored —
An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code thro…
-
Unscored —
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of Syste…
-
Unscored —CVE-2019-15679 EPSS 12%
TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially r…
-
Unscored —CVE-2019-15678 EPSS 13%
TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result co…
-
Unscored —CVE-2019-8287 EPSS 19%
TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially re…
-
Unscored —
An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execut…
-
Unscored —
An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization…
-
Critical 9.8
SQL Injection in sequelize
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
-
Unscored —
LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, whic…
-
Unscored —
Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.
-
Unscored —
An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within ove…
-
Unscored —
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFi…
-
High 7.5
Cezerin Unauthorized Acces
Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or s…
-
Unscored —CVE-2019-6851 EPSS 29%
A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium …
-
Unscored —
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, whi…
-
Unscored —
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, whi…
-
Unscored —CVE-2019-6848 EPSS 32%
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M…
-
Unscored —
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxC…
-
Unscored —
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon …
-
Unscored —
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon …
-
Unscored —
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxC…
-
Unscored —
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prio…
-
Unscored —
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxC…
-
Unscored —CVE-2019-6841 EPSS 24%
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prio…
-
Unscored —
OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized …
-
Unscored —
OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because unin…
-
Unscored —
OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote…
-
High 7.8
Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL exec…
-
High 7.5
A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before…
-
Low 3.1
Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.
-
Unscored —
mediawiki allows deleted text to be exposed
-
Unscored —
-
Unscored —
Bitlbee does not drop extra group privileges correctly in unix.c
-
Unscored —
-
Unscored —
-
Unscored —
qtparted has insecure library loading which may allow arbitrary code execution