Skip to content
OpenAdvisories

Archive

6 November 2019

Vulnerabilities first published on this day (UTC), newest first.

← October 2019 2019 / November /6 December 2019 →
  1. 132
  2. 210
  3. 3 
  4. 443
  5. 5119
  6. 6112
  7. 765
  8. 827
  9. 929
  10. 10 
  11. 1110
  12. 12138
  13. 13111
  14. 14262
  15. 1536
  16. 163
  17. 174
  18. 1877
  19. 1931
  20. 2042
  21. 21106
  22. 2258
  23. 23 
  24. 24 
  25. 25154
  26. 26120
  27. 2749
  28. 2810
  29. 2933
  30. 305
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2019-12419 EPSS 14%

    Potential session hijack in Apache CXF

    Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to…

    Apache Apache CXF org.apache.cxf:cxf Maven
  • Critical 10.0
    CVE-2019-5644

    C4G BLIS Improper Access Control

    Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, includin…

    Computing For Good Basic Laboratory Information System
  • Critical 10.0
    CVE-2019-5617

    C4G BLIS Improper Access Control

    Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level u…

    Computing For Good Basic Laboratory Information System
  • Critical 9.8
    CVE-2011-4628

    Typo3 Authentication Bypass

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.

    TYPO3 typo3 typo3/cms Web / CMS Packagist
  • Critical 9.8
    CVE-2019-8158

    Magento 2 Community Edition XML Injection

    An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. …

    Adobe Magento 2 magento/community-edition Web / CMS Packagist