Archive
7 November 2019
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
Unscored —
-
Unscored —
FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and t…
-
Unscored —
In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JB…
-
High 8.6
Improper Verification of Cryptographic Signature in matrix-synapse
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.
-
Unscored —
frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the …
-
Unscored —
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".
-
Unscored —
Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to …
-
Unscored —
clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.
-
Unscored —
The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.
-
Unscored —
viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.
-
Unscored —
TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' para…
-
Unscored —
Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.
-
Unscored —
Mondo 2.24 has insecure handling of temporary files.
-
Unscored —
In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segment…
-
Critical 9.8
Strapi allows unauthenticated attacker to reset admin password without valid reset token
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
-
Unscored —
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail conte…
-
Unscored —
Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary we…
-
Unscored —
Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiVectorRender!StrokeText_Blend+0x00000000000003a7.
-
Unscored —
Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProf…
-
Unscored —
Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.
-
Unscored —
ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
-
Unscored —
syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and s…
-
Unscored —
The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DE…
-
Unscored —
Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrar…
-
Unscored —
gitolite before 1.4.1 does not filter src/ or hooks/ from path names.
-
Unscored —
The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October…
-
High 8.8
Signature validation bypass in XmlSecLibs
Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating…
-
Unscored —
Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurat…
-
Unscored —
Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user wi…
-
Medium 5.0
Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.…
-
Unscored —
Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize t…
-
Unscored —
Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attac…
-
Unscored —
An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that sig…
-
Medium —
Tahoe-LAFS fails to ensure integrity
Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.
-
Unscored —
OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.
-
Unscored —
A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms.
-
Unscored —
A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC_TIME systems…
-
Unscored —
Use after free vulnerability in documentloader in WebKit in Google Chrome before Blink M13 in DocumentWriter::replaceDo…
-
Unscored —
Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13.
-
Unscored —
PopojiCMS 2.0.1 allows refer= Open Redirection.