Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
187 results · Clear filters · Feed
-
Medium 5.7
Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork fro…
-
Medium 6.1
Pimcore Cross-site Scripting (XSS) vulnerability
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
-
Medium 5.3
The rack-cors rubygem may allow directory traveral
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
-
Medium 6.5
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potent…
-
Medium 4.3
Moodle included private user files in course backups
Moodle before 2.2.2: Overview report allows users to see hidden courses
-
Medium 4.3
Moodle default permissions too permissive
Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
-
Medium 4.3
Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could l…
-
Medium 4.3
Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could l…
-
Medium 4.3
Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could l…
-
Medium 4.3
Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could l…
-
Medium 4.8
Data Loss Prevention - Unprotected Transport of Credentials
Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when t…
-
Medium 6.5
Advanced Threat Defense (ATD) - Path Traversal: '/absolute/pathname/here' vulnerability
Path Traversal: '/absolute/pathname/here' vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to gain unintended access to files on the system via carefully constructed HTTP requests.
-
Medium 5.3
Pomelo allows external control of critical state data
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via …
-
Medium 5.3
Advanced Threat Defense (ATD) - Information Disclosure vulnerability
Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD prior to 4.8 allows remote authenticated attackers to gain access to the atduser credentials via carefully constructed GET request extracting insecurely information stored in the data…
-
Medium 5.3
Advanced Threat Defense (ATD) - Information Disclosure vulnerability
Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attackers to gain access to hashed credentials via carefully constructed POST request extracting incorrectly recorded data from log files.
-
Medium 4.3
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
-
Medium 4.5
Exploitation of Authorization in TIE Server
Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.
-
Medium 6.1
Implicit loading of DLLs
A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary code via carefully placing malicious files in specific locations protected by administrator permiss…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without suffici…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in r…
-
Medium 5.1
IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Win…
-
Medium 6.1
Elgg Reflected XSS Vulnerability
Elgg through 1.7.10 has XSS
-
Medium 6.5
HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
-
Medium 6.1
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…
-
Medium 6.1
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 4.3
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an auth…
-
Medium 4.3
IBM QRadar Advisor 1.0.0 through 2.4.0 uses incomplete blacklisting for input validation which allows attackers to bypa…
-
Medium 5.4
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…
-
Medium 5.4
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…
-
Medium 6.1
IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 4.3
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive informat…
-
Medium 4.3
IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in fu…
-
Medium 4.8
Medtronic Valleylab FT10 and LS10 Improper Authentication
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authe…
-
Medium 4.6
Medtronic Valleylab FT10 and LS10 Protection Mechanism Failure
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism does not apply…
-
Medium 5.8
Medtronic Valleylab FT10 and FX8 Use of Hard-coded Credentials
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard-coded credentials. …
-
Medium 6.5CVE-2019-10219 Public exploit
The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
-
Medium 5.9
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-te…
-
Medium 6.5
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute v…
-
Medium 5.0
Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.…
-
Medium —
Tahoe-LAFS fails to ensure integrity
Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.