Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
11 results · Clear filters · Feed
-
Low 3.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siem…
-
Low 3.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siem…
-
Low 3.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siem…
-
Low 3.7
ecdsa Denial of Service vulnerability in signature verification and signature malleability
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
-
Low 3.1
RabbitMQ XSS attack via federation and shovel endpoints
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input…
-
Low 3.7
IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about i…
-
Low 3.7
IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cooki…
-
Low 3.1
Jenkins QMetry for JIRA Plugin shows plain text password in configuration form
Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
-
Low —
Plaintext Storage in Jenkins Spira Importer Plugin
Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.7
IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauth…
-
Low 3.3
MAGICK
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where…