Archive
8 November 2019
Vulnerabilities first published on this day (UTC), newest first.
27 results · Feed
-
Medium 4.8
Medtronic Valleylab FT10 and LS10 Improper Authentication
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authe…
-
Medium 4.6
Medtronic Valleylab FT10 and LS10 Protection Mechanism Failure
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism does not apply…
-
High 7.0
Medtronic Valleylab FT10 and FX8 Reversible One-way Hash
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password ha…
-
Medium 5.8
Medtronic Valleylab FT10 and FX8 Use of Hard-coded Credentials
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard-coded credentials. …
-
Unscored —
The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vu…
-
Unscored —
The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permis…
-
High 7.5
Missing Initialization of Resource in Apache Arrow
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory b…
-
High 7.5
Missing Initialization of Resource in Apache Arrow
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R imp…
-
High 8.8
A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to…
-
Unscored —
JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input paramet…
-
Unscored —
Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user cli…
-
High —
Default Express middleware security check is ignored in production
## Default Express middleware security check is ignored in production ### Impact All Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected. ### Pat…
-
Unscored —
In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allo…
-
Unscored —
A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to pe…
-
Unscored —
The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’…
-
Unscored —
A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID…
-
Unscored —
Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.
-
Unscored —
Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptog…
-
Unscored —
Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to acces…
-
Unscored —
mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI…
-
Medium 6.5CVE-2019-10219 Public exploit
The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
-
Medium 5.9
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-te…
-
High 7.4
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacke…
-
Medium 6.5
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute v…
-
High 7.5
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated…
-
Unscored —
tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service.
-
Unscored —
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate …