Archive
20 November 2019
Vulnerabilities first published on this day (UTC), newest first.
42 results · Feed
-
High 7.5
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Pre…
-
Unscored —
A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720,…
-
Unscored —
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, …
-
Unscored —
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x b…
-
Unscored —
Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote a…
-
Unscored —
Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in …
-
Unscored —
SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the…
-
Unscored —
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers …
-
Unscored —CVE-2012-1257 Public exploit
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information v…
-
Unscored —
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application cras…
-
Unscored —
Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web sc…
-
Unscored —
Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary we…
-
Unscored —
kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwis…
-
Unscored —
The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a…
-
Unscored —
The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/stat…
-
Unscored —
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
-
Unscored —
Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.
-
Medium 4.3
IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they shou…
-
High 8.0
IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by th…
-
Unscored —
Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..
-
Critical 9.8
Arbitrary File Write in iobroker.admin
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.
-
Unscored —
Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP.
-
Unscored —
VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain a denial-of-service vulnerability in th…
-
Unscored —
VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in…
-
Unscored —
VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an information disclosure vulnerability…
-
Unscored —
Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75.
-
Unscored —
Unspecified vulnerabilities in Google Chrome before 54.0.2840.59.
-
Critical 9.8
Smarty3 Arbitrary PHP Code Execution
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.
-
Unscored —
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via un…
-
Unscored —
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via un…
-
Unscored —
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via un…
-
Unscored —
tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.
-
Unscored —
GNU Serveez through 0.2.2 has an Information Leak. An attacker may send an HTTP POST request to the /cgi-bin/reader URI…
-
Unscored —
Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, c…
-
Unscored —
Openfind MAIL2000 Webmail Pre-Auth Open Redirect
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
-
Unscored —
Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulner…
-
Unscored —
A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalatio…
-
Unscored —
A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow…
-
Unscored —
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrativ…
-
Unscored —
A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow…