Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
1,686 results · Feed
-
Unscored —
Free Photo Viewer 1.3 allows remote attackers to execute arbitrary code via a crafted BMP and/or TIFF file that trigger…
-
Unscored —
The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check.
-
Unscored —
The CBC Gem application before 9.24.1 for Android and before 9.26.0 for iOS has Unencrypted Analytics.
-
Unscored —
relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as…
-
Unscored —
Zabbix before 5.0 represents passwords in the users table with unsalted MD5.
-
Unscored —
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current enco…
-
Unscored —
The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive informatio…
-
Unscored —
illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple th…
-
Unscored —
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which all…
-
Unscored —
cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers …
-
Unscored —CVE-2015-1855 Public exploit
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x…
-
Unscored —
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a S…
-
Unscored —
Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability…
-
Unscored —
There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the clou…
-
Unscored —
Mate 20 RS smartphones with versions earlier than 9.1.0.135(C786E133R3P1) have an improper authorization vulnerability.…
-
Unscored —
Huawei Atlas 300, Atlas 500 have a buffer overflow vulnerability. A local, authenticated attacker may craft specific pa…
-
Unscored —
Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an a…
-
Unscored —
Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain program…
-
Unscored —
There is an insufficient authentication vulnerability in Huawei Band 2 and Honor Band 3. The band does not sufficiently…
-
Unscored —
The Huawei Share function of P20 phones with versions earlier than Emily-L29C 9.1.0.311 has an improper file management…
-
Unscored —
There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote a…
-
Unscored —
There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to ce…
-
Unscored —
Nova 5i pro and Nova 5 smartphones with versions earlier than 9.1.1.190(C00E190R6P2)and Versions earlier than 9.1.1.175…
-
Unscored —
P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions ea…
-
Unscored —
HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions …
-
Unscored —
P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21) have an out of bounds read vulnerability.…
-
Unscored —
P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions e…
-
Unscored —
P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions ea…
-
Unscored —
A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] a…
-
Medium 6.6
In EzMaster before 5.2.11 docker containers were executed with advanced privileges by default
The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced capabilities (not launched as root)
-
High 8.7
2FA bypass in Wagtail through new device path
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been …
-
High 7.8
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in in…
-
Unscored —
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can l…
-
Unscored —
In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue t…
-
High 8.8CVE-2019-14901 EPSS 16%
A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip dr…
-
Medium 6.6
A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att…
-
High 8.0
A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell…
-
Medium 5.9
A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pre…
-
Unscored —
A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to in…
-
Unscored —
A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to…