Archive
15 November 2019
Vulnerabilities first published on this day (UTC), newest first.
36 results · Feed
-
Medium 5.7
Validator parsing discrepancy due to string encoding in NPM slpjs
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP con…
-
Medium 5.7
Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork fro…
-
Unscored —
On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follo…
-
Unscored —
On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when …
-
Unscored —
The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1…
-
Unscored —
When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes c…
-
Unscored —
On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of s…
-
Unscored —
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manuf…
-
Unscored —
On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undis…
-
Unscored —
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manuf…
-
Unscored —
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a…
-
Unscored —
Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2…
-
Unscored —
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which …
-
Unscored —
Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business E…
-
Unscored —
qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-exe…
-
Unscored —
Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability …
-
Unscored —CVE-2018-18368 Public exploit
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerabil…
-
Unscored —
The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid cal…
-
Unscored —
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File uplo…
-
Unscored —
In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to ove…
-
Unscored —
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK1…
-
Unscored —
OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution
-
Unscored —
Chrony before 1.29.1 has traffic amplification in cmdmon protocol
-
Unscored —
-
Unscored —
-
Unscored —
-
Unscored —
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP…
-
Unscored —
TemaTres 3.0 allows remote unprivileged users to create an administrator account
-
Unscored —
TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.
-
High 7.3
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not prop…
-
Unscored —
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (acci…
-
Critical 9.8
Pimcore Access Control Issues
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
-
Medium 6.1
Pimcore Cross-site Scripting (XSS) vulnerability
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
-
Critical 9.8
Pimcore 2FA Vulnerable to Brute Forcing
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
-
High 7.5
Pimcore Discloses Usernames In Use
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
-
Unscored —
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpr…