Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
1,686 results · Feed
-
Unscored —
quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal
-
Unscored —
gnome-system-log polkit policy allows arbitrary files on the system to be read
-
Unscored —
vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matchin…
-
Medium 6.2
Incorrect Default Permissions in keyring
Python keyring has insecure permissions on new databases allowing world-readable files to be created
-
Unscored —
A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method ca…
-
High 7.8
A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marv…
-
Medium 6.4
containers/image library Insufficiently Protects Credentials
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker…
-
Medium 5.0
A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can re…
-
High 7.5
Use of Externally-Controlled Input to Select Classes or Code in Infinispan
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce n…
-
Medium 4.3
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and d…
-
Medium 4.1
Katello cleartext password storage issue
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials …
-
Medium 4.5CVE-2019-11287 Public exploit
RabbitMQ Web Management Plugin DoS via heap overflow
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack…
-
Low 3.1
RabbitMQ XSS attack via federation and shovel endpoints
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input…
-
Unscored —
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a …
-
Unscored —
An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by chan…
-
Unscored —
If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extr…
-
Unscored —
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to…
-
Unscored —
In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerab…
-
Unscored —
The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker …
-
Critical 9.8
SQL injection in phpMyAdmin
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
-
Unscored —
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.…
-
Medium 5.3
Client Proxy (MCP) - Authentication Bypass vulnerability
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key…
-
Unscored —
W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download t…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to in…
-
Unscored —
Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbit…
-
Unscored —
W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the…
-
Unscored —CVE-2013-6234 Public exploit
Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated user…
-
Unscored —
Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect u…
-
Unscored —
W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remot…
-
Unscored —
Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to re…
-
Medium 4.8
XSS in Pannellum from 2.5.0 through 2.5.4
In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The mos…
-
Unscored —
Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier.
-
Unscored —
generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attacke…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remo…
-
Unscored —
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers…
-
Unscored —
Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' func…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attac…
-
Medium 6.1
Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'.…