Archive
6 November 2019
Vulnerabilities first published on this day (UTC), newest first.
112 results · Feed
-
Unscored —
Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon…
-
Unscored —
Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon…
-
Unscored —
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are at…
-
Unscored —
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote aut…
-
Unscored —
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin …
-
Critical 9.8CVE-2019-12419 EPSS 14%
Potential session hijack in Apache CXF
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to…
-
Unscored —
A stale layout root is set as an input element in WebKit in Google Chrome before Blink M13 when a child of a keygen wit…
-
Medium 6.5
Potential DOS attack due to unrestricted attachment count in messages
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of m…
-
Unscored —
JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.
-
Unscored —
Dump Servlet information leak in jetty before 6.1.22.
-
High 8.8
An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A special…
-
High 8.8
An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20. A specially cr…
-
High 8.8
An exploitable integer underflow vulnerability exists in the CMP-parsing functionality of LEADTOOLS 20. A specially cra…
-
High 8.8
An exploitable heap out-of-bounds write vulnerability exists in the TIF-parsing functionality of LEADTOOLS 20. A specia…
-
Unscored —
In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible…
-
Unscored —
An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plu…
-
Unscored —
konversation before 1.2.3 allows attackers to cause a denial of service.
-
Unscored —
An Integer Overflow exists in WebKit in Google Chrome before Blink M11 in the macOS WebCore::GraphicsContext::fillRect …
-
Unscored —
WebApp JSP Snoop page XSS in jetty though 6.1.21.
-
Unscored —
Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.
-
Critical 10.0
C4G BLIS Improper Access Control
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, includin…
-
Medium 5.3
C4G BLIS Improper Access Control
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may enumerate the user names and facility names in u…
-
Low 3.3
MAGICK
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where…
-
Critical 10.0
C4G BLIS Improper Access Control
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level u…
-
Unscored —
Pagure: XSS possible in file attachment endpoint
-
Unscored —
MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console
-
Unscored —
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES N…
-
Unscored —
An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access …
-
Unscored —
An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address …
-
Unscored —
Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdra…
-
Unscored —
Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Sna…
-
Unscored —
Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in S…
-
Unscored —
When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to o…
-
Unscored —
Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Sn…
-
Unscored —
Out of bound write issue is observed while giving information about properties that have been set so far for playing vi…
-
Unscored —
While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lea…
-
Unscored —
Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound acc…
-
Unscored —
While deserializing any key blob during key operations, buffer overflow could occur exposing partial key information if…
-
Unscored —
Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Sna…
-
Unscored —
Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Sna…