Archive
October 2019
Vulnerabilities first published in this month (UTC), newest first.
1,573 results · Feed
-
High 7.4
Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web …
-
High 7.4
An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web re…
-
Critical 10.0
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise th…
-
Critical 10.0
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise th…
-
Critical 10.0
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise th…
-
Unscored —
CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow.
-
Medium 5.4
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by i…
-
Medium 4.3
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directorie…
-
Medium 5.9
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms t…
-
Medium 5.4
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, ca…
-
Low 2.3
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to s…
-
Medium 4.0
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive informa…
-
High 7.5
IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse …
-
Unscored —
RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when …
-
Unscored —
Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.
-
Unscored —
TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities.
-
Unscored —
D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be crea…
-
Unscored —
D-Link DIR-865L has Information Disclosure.
-
Unscored —
D-Link DIR-865L has PHP File Inclusion in the router xml file.
-
Unscored —
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability. Successful exploita…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful …
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful …
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation c…
-
Unscored —
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful explo…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability. Successful exploit…
-
Critical 9.8
Zend Framework Allows SQL Injection
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
-
Unscored —
browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Wind…
-
Unscored —
Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory.
-
Unscored —
Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or pas…
-
Unscored —
Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected…
-
Unscored —
Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credential…
-
Unscored —
Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across di…
-
Unscored —CVE-2019-17596 Public exploit
Panic on invalid DSA public keys in crypto/dsa
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
-
Unscored —CVE-2019-18418 Public exploit
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests b…
-
Unscored —
A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to in…
-
Unscored —
Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.
-
Unscored —
Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can res…