Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
87 results · Clear filters · Feed
-
Unscored —
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-b…
-
Unscored —CVE-2018-18368 Public exploit
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerabil…
-
Unscored —CVE-2019-11931 Public exploit
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user…
-
Unscored —CVE-2019-18980 Public exploit
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users…
-
Unscored —CVE-2019-14678 Public exploit
SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in mult…
-
Unscored —CVE-2019-18885 Public exploit
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a craf…
-
Unscored —
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. Thi…
-
Critical 9.8CVE-2019-3663 Public exploit
Advanced Threat Defense (ATD) - Unprotected storage of shared credentials vulnerability
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of Hi…
-
Unscored —
SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files.
-
Critical 9.8
An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.…
-
Unscored —CVE-2014-1214 Public exploit
views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote atta…
-
Unscored —CVE-2012-5193 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arb…
-
Unscored —CVE-2012-2237 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote at…
-
Unscored —CVE-2019-2198 Public exploit
In Download Provider, there is a possible SQL injection vulnerability. This could lead to local information disclosure …
-
Unscored —CVE-2019-2196 Public exploit
In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no addition…
-
Unscored —CVE-2019-2205 Public exploit
In ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption due to a use after free…
-
Unscored —
-
Unscored —CVE-2012-4384 Public exploit
letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Cal…
-
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
Unscored —CVE-2019-1422 Public exploit
An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a fi…
-
Unscored —CVE-2019-1402 Public exploit
An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle …
-
High 7.8
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allow…
KEV Mar 15, 2022 -
High 7.8
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user…
KEV Apr 7, 2023 -
Unscored —CVE-2019-17234 Public exploit
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrar…
-
Unscored —
File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulner…
-
Unscored —CVE-2019-18873 Public exploit
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An…
-
Unscored —CVE-2019-18862 Public exploit
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.
-
Unscored —CVE-2019-18845 Public exploit
The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity proces…
-
Medium 6.5CVE-2019-10219 Public exploit
The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
-
Critical 9.8
Strapi allows unauthenticated attacker to reset admin password without valid reset token
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
-
Unscored —
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote aut…
-
Unscored —
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin …
-
Unscored —CVE-2019-10529 Public exploit
Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function se…
-
Medium 5.9CVE-2013-5123 Public exploit
Improper Authentication in pip
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
-
Medium 5.8CVE-2019-1978 Public exploit
Cisco Firepower Threat Defense Software Stream Reassembly Bypass Vulnerability
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protec…
-
Unscored —CVE-2013-6275 Public exploit
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
-
Unscored —CVE-2013-6364 Public exploit
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
-
High 7.5CVE-2019-17221 Public exploit
PhantomJS Arbitrary File Read
PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An at…
-
Unscored —CVE-2019-13497 Public exploit
One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests.
-
Unscored —CVE-2019-13496 Public exploit
One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, th…