Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
1,686 results · Feed
-
Unscored —
Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authe…
-
Unscored —
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0x…
-
High 8.0CVE-2019-10220 Public exploit
Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.
-
Unscored —
ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when rep…
-
Unscored —
ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection …
-
Unscored —
In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are d…
-
Unscored —
In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing…
-
High 7.3
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properl…
-
Unscored —CVE-2019-15298 EPSS 27%
A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/…
-
Low 3.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siem…
-
Low 3.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siem…
-
Low 3.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siem…
-
Unscored —
A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Admi…
-
High 7.3
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling sc…
-
High 8.8
Code injection in FreeIPA
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unaut…
-
High 7.8
A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip d…
-
Medium 5.7
FreeIPA logs passwords embedded in commands in calls using batch
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA mast…
-
Unscored —
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
-
Unscored —CVE-2011-1939 Public exploit
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compat…
-
Unscored —
-
Unscored —
SQL injection vulnerability in Jifty::DBI before 0.68.
-
Unscored —
The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it a…
-
Unscored —
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header i…
-
Unscored —
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAl…
-
Unscored —
PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_L…
-
Unscored —
PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActiv…
-
Unscored —
Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issu…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Inse…
-
Unscored —
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has In…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filterin…
-
Unscored —CVE-2019-12526 EPSS 20%
An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public p…
-
Unscored —
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HT…
-
Critical 9.8
Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerabi…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feat…
-
Unscored —
An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious im…