Archive
22 November 2019
Vulnerabilities first published on this day (UTC), newest first.
58 results · Feed
-
Medium 4.5CVE-2019-11287 Public exploit
RabbitMQ Web Management Plugin DoS via heap overflow
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack…
-
Low 3.1
RabbitMQ XSS attack via federation and shovel endpoints
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input…
-
Unscored —
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a …
-
Unscored —
An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by chan…
-
Unscored —
If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extr…
-
Unscored —
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to…
-
Unscored —
In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerab…
-
Unscored —
The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker …
-
Critical 9.8
SQL injection in phpMyAdmin
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
-
Unscored —
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.…
-
Medium 5.3
Client Proxy (MCP) - Authentication Bypass vulnerability
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key…
-
Unscored —
W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download t…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to in…
-
Unscored —
Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbit…
-
Unscored —
W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the…
-
Unscored —CVE-2013-6234 Public exploit
Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated user…
-
Unscored —
Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect u…
-
Unscored —
W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remot…
-
Unscored —
Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to re…
-
Medium 4.8
XSS in Pannellum from 2.5.0 through 2.5.4
In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The mos…
-
Unscored —
Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier.
-
Unscored —
generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attacke…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remo…
-
Unscored —
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers…
-
Unscored —
Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' func…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attac…
-
Medium 6.1
Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'.…
-
Unscored —
Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites a…
-
Unscored —
An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operati…
-
Unscored —CVE-2019-18610 EPSS 50%
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through …
-
Unscored —
The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input fo…
-
Unscored —
An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when i…
-
Unscored —CVE-2019-18976 EPSS 13%
An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If …
-
Unscored —
An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x be…
-
Unscored —
-
Unscored —
PostfixAdmin 2.3.4 has multiple XSS vulnerabilities
-
High 8.8
Pagekit File Upload vulnerability
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
-
Unscored —
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker cou…