Archive
21 November 2019
Vulnerabilities first published on this day (UTC), newest first.
106 results · Feed
-
Unscored —
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal.
-
Unscored —
Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7…
-
Unscored —
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who register…
-
Unscored —
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overw…
-
Unscored —
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overw…
-
Critical 9.8CVE-2019-18889 EPSS 33%
Symfony Unsafe Cache Serialization Could Enable RCE
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
-
High 7.5
Argument injection in a MimeTypeGuesser in Symfony
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are…
-
High 8.1
Symfony Http-Kernel has non-constant time comparison in UriSigner
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
-
Critical 9.8
Improper Input Validation in Symfony
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
-
Unscored —
wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.
-
Unscored —
wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
-
Unscored —
wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
-
Unscored —CVE-2012-1001 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers …
-
Unscored —CVE-2014-8356 Public exploit
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended …
-
Unscored —CVE-2015-3140 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, S…
-
Unscored —CVE-2019-19207 EPSS 22%
rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.
-
Unscored —CVE-2019-19203 Public exploit
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UCh…
-
Unscored —CVE-2019-19204 Public exploit
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as…
-
Unscored —
In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to …
-
Unscored —
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote a…
-
Unscored —
Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to …
-
Unscored —
The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive informa…
-
Unscored —CVE-2013-3314 Public exploit
The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2…
-
High 7.5
Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service
When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and p…
-
Medium 5.3
Beckhoff TwinCAT Discovery Service Denial of Service
When a Beckhoff TwinCAT Runtime receives a malformed UDP packet, the ADS Discovery Service shuts down. Note that the TwinCAT devices are still performing as normal. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prio…
-
Unscored —
IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escal…
-
Unscored —
In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal tec…
-
Unscored —
HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.
-
Unscored —CVE-2019-19033 Public exploit
Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges …
-
Critical 9.8
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
KEV Feb 3, 2026 -
Unscored —CVE-2019-15511 Public exploit
An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due …
-
Unscored —CVE-2019-18890 Public exploit
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected…
-
Medium 5.3
User enumeration leak using switch user functionality in Symfony
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is…
-
Unscored —
Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual m…
-
High 7.2
Improper Input Validation in Centreon Web
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one anot…
-
Unscored —
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controll…
-
High 7.8
An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Rou…
-
High 7.8
An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Rou…