Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
87 results · Clear filters · Feed
-
Unscored —CVE-2015-1855 Public exploit
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x…
-
High 7.8CVE-2019-18276 Public exploit
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run wi…
-
Unscored —
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
-
Unscored —
Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authe…
-
High 8.0CVE-2019-10220 Public exploit
Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.
-
Unscored —CVE-2011-1939 Public exploit
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compat…
-
Unscored —
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.
-
Unscored —CVE-2019-12489 Public exploit
An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_r…
-
Unscored —
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user co…
-
Unscored —CVE-2011-4090 Public exploit
Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.
-
Medium 5.4CVE-2019-15972 Public exploit
Cisco Unified Communications Manager SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management inter…
-
High 7.7
Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability
A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists due to a failure of the HT…
-
Unscored —
Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.
-
Medium 6.5
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…
KEV Jun 8, 2022 -
High 8.8
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…
KEV May 23, 2022 -
Medium 4.7CVE-2019-10207 Public exploit
A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…
-
Medium 4.5CVE-2019-11287 Public exploit
RabbitMQ Web Management Plugin DoS via heap overflow
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack…
-
Unscored —CVE-2013-6234 Public exploit
Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated user…
-
Unscored —CVE-2012-1001 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers …
-
Unscored —CVE-2014-8356 Public exploit
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended …
-
Unscored —CVE-2015-3140 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, S…
-
Unscored —CVE-2019-19203 Public exploit
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UCh…
-
Unscored —CVE-2019-19204 Public exploit
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as…
-
Unscored —CVE-2013-3314 Public exploit
The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2…
-
Unscored —
In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal tec…
-
Unscored —CVE-2019-19033 Public exploit
Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges …
-
Unscored —CVE-2019-15511 Public exploit
An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due …
-
Unscored —CVE-2019-18890 Public exploit
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected…
-
High 7.2
Improper Input Validation in Centreon Web
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one anot…
-
Medium 6.5
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attack…
KEV Jun 25, 2025 -
Unscored —CVE-2012-1257 Public exploit
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information v…
-
Unscored —
ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified co…
-
Unscored —CVE-2011-4919 Public exploit
mpack 1.6 has information disclosure via eavesdropping on mails sent by other users
-
High 7.5CVE-2019-12422 Public exploit
Improper input validation in Apache Shiro
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
-
Critical 9.8
Unrestricted upload of file with dangerous type in Apache Solr
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, the…
-
Medium 6.1CVE-2019-10070 Public exploit
Stored XSS in Apache Atlas
Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
-
Unscored —CVE-2019-5688 Public exploit
NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvf…
-
Unscored —CVE-2011-5331 Public exploit
Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.
-
Medium 5.9
Improper Restriction of XML External Entity Reference in jackson-mapper-asl
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
-
Unscored —CVE-2018-13257 Public exploit
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header sp…