Archive
18 November 2019
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
High 7.5CVE-2019-12422 Public exploit
Improper input validation in Apache Shiro
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
-
Unscored —
Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability
-
High 7.4
Timing attacks might allow practical recovery of the long-term private key
In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication…
-
Unscored —
A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.
-
Medium 6.1
Jenkins CI Game Plugin allows Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.
-
Unscored —
/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticat…
-
Medium 6.1
Jenkins Violation Plugin allows Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin.
-
Unscored —
Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. In this type of circumstance, the exploit …
-
Medium 6.1
Jenkins allows Cross-Site Scripting (XSS) via Crafted URL
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.
-
Critical 9.8
Unrestricted upload of file with dangerous type in Apache Solr
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, the…
-
High 8.8
Jenkins allows Data Insertion and Execution of Code by those with Read and HTTP Access
Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbi…
-
Unscored —
XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.…
-
Medium 6.1CVE-2019-10070 Public exploit
Stored XSS in Apache Atlas
Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
-
Unscored —
An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. A DLL Preloading vulnerabili…
-
Medium 6.5
Data leakage via SQL Injection in Pimcore
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' pa…
-
Unscored —
Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a scri…
-
Unscored —
Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.
-
Unscored —
authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An att…
-
Unscored —
permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices…
-
Unscored —
Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of addi…
-
Unscored —
An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway …
-
Medium 4.0
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.…
-
Medium 4.0
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.…
-
Unscored —CVE-2019-5688 Public exploit
NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvf…
-
Unscored —CVE-2011-5331 Public exploit
Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.
-
Unscored —
Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls.
-
Unscored —
main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCateg…
-
Unscored —
Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server becau…
-
Medium 5.9
Improper Restriction of XML External Entity Reference in jackson-mapper-asl
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
-
Unscored —
A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authentic…
-
Unscored —
In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could u…
-
Unscored —CVE-2018-13257 Public exploit
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header sp…
-
Unscored —
The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a mal…
-
Unscored —
Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a …
-
Unscored —
Footy Tipping Software AFL Web Edition 2019 allows XSS.
-
Unscored —
Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 …
-
Unscored —
Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.…
-
Unscored —
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the …
-
Unscored —
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in t…