Archive
21 November 2019
Vulnerabilities first published on this day (UTC), newest first.
12 results · Clear filters · Feed
-
High 7.5
Argument injection in a MimeTypeGuesser in Symfony
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are…
-
High 8.1
Symfony Http-Kernel has non-constant time comparison in UriSigner
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
-
High 7.5
Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service
When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and p…
-
High 7.2
Improper Input Validation in Centreon Web
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one anot…
-
High 7.8
An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Rou…
-
High 7.8
An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Rou…
-
High 7.5
Arbitrary File Write in iobroker.js-controller
An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to…
-
High 8.8
An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm bi…
-
High 7.5
An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm bi…
-
High 7.1
Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files
A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.
-
High 8.8
Incorrect Authorization in Jenkins Script Security Plugin
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
-
High 7.5
trytond Incorrect Authorization vulnerability
trytond 2.4: ModelView.button fails to validate authorization