Archive
19 November 2019
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Unscored —
Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by s…
-
Unscored —
masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper priv…
-
Unscored —
lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled…
-
Medium 5.3
Apache NiFi process group information disclosure
When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user…
-
High 8.8
Apache NiFi user log out issue
When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used …
-
Medium 6.5
Apache NiFi information disclosure by XXE
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions o…
-
Unscored —
foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by renderi…
-
Unscored —
foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering …
-
High 7.5
angular Prototype Pollution vulnerability
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
-
Critical 9.8
SQL Injection in usmanhalalit/pixie
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
-
High 8.6
A forged route service request using an invalid nonce can cause the gorouter to panic and crash
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.
-
Unscored —
ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate priv…
-
Unscored —
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after recei…
-
Medium 4.4
cookie-signature Timing Attack
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
-
Unscored —
ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified co…
-
High 7.5
RubyGems passenger gem allows remote attackers to delete files
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.
-
Unscored —
nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.
-
Unscored —
Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security…
-
Unscored —
-
Unscored —
-
Unscored —
cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE
-
Unscored —CVE-2011-4919 Public exploit
mpack 1.6 has information disclosure via eavesdropping on mails sent by other users
-
High 8.8
Cobbler Web Interface Lacks CSRF Protection
cobbler: Web interface lacks CSRF protection when using Django framework
-
Unscored —
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle a…
-
Unscored —
-
Unscored —
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file …
-
Unscored —
-
Unscored —
hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.
-
Unscored —
Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attac…
-
Unscored —
Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative …
-
Unscored —
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC envi…