Archive
13 November 2019
Vulnerabilities first published on this day (UTC), newest first.
111 results · Feed
-
Critical 9.8CVE-2019-3663 Public exploit
Advanced Threat Defense (ATD) - Unprotected storage of shared credentials vulnerability
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of Hi…
-
Medium 6.5
Advanced Threat Defense (ATD) - Path Traversal: '/absolute/pathname/here' vulnerability
Path Traversal: '/absolute/pathname/here' vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to gain unintended access to files on the system via carefully constructed HTTP requests.
-
High 8.1
Advanced Threat Defense (ATD) - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads.
-
Medium 5.3
Pomelo allows external control of critical state data
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via …
-
High 8.4
Advanced Threat Defense (ATD) - Improper Neutralization of HTTP requests
Improper Neutralization of HTTP requests in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute commands on the server remotely via carefully constructed HTTP requests.
-
Unscored —
-
Medium 5.3
Advanced Threat Defense (ATD) - Information Disclosure vulnerability
Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD prior to 4.8 allows remote authenticated attackers to gain access to the atduser credentials via carefully constructed GET request extracting insecurely information stored in the data…
-
High 8.8
Advanced Threat Defense (ATD) - Information Disclosure vulnerability
Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD prior to 4.8 allows remote authenticated attackers to gain access to ePO as an administrator via using the atduser credentials, which were too permissive.
-
Unscored —
SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-1895…
-
Unscored —
SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files.
-
Critical 9.8
An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.…
-
Unscored —
Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacke…
-
Medium 5.3
Advanced Threat Defense (ATD) - Information Disclosure vulnerability
Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attackers to gain access to hashed credentials via carefully constructed POST request extracting incorrectly recorded data from log files.
-
Unscored —
All versions up to V2.5.0_EG1T5_TED of ZTE ZXHN H108N product are impacted by an information leak vulnerability. An att…
-
Unscored —
In Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU: serial number 21081 and prior, Q04/06/13/26UDPVCPU: seria…
-
Unscored —CVE-2019-18240 EPSS 14%
In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an…
-
Unscored —
Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HAN…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2…
-
Unscored —
SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an at…
-
Unscored —
Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to …
-
Unscored —
Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information w…
-
Unscored —
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an…
-
Unscored —
A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Pub…
-
Unscored —
An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31,…
-
Unscored —
SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scrip…
-
Unscored —
Unspecified Cross-site scripting (XSS) vulnerability in the Verizon FIOS Actiontec MI424WR-GEN3I router.
-
Unscored —
pithos before 0.3.5 allows overwrite of arbitrary files via symlinks.
-
Unscored —
In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated…
-
Unscored —
Insufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arb…
-
Unscored —
Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of passwor…
-
Unscored —
udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules.
-
Unscored —
hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the Zen theme 6.x-1.x, 7.x-3…
-
Unscored —
Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML paramet…
-
Unscored —CVE-2014-1214 Public exploit
views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote atta…
-
Unscored —CVE-2012-5193 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arb…
-
Unscored —
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an …
-
Unscored —
The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). Th…
-
Unscored —
PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by…
-
Unscored —
An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a s…