Archive
November 2019
Vulnerabilities first published in this month (UTC), newest first.
1,686 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated …
-
Unscored —
There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.
-
Unscored —
In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
-
Unscored —
Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.
-
Unscored —
Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.
-
Unscored —
In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.
-
Unscored —
Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.
-
Unscored —
Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass …
-
Medium 6.4
Ansible password prompts could expose passwords
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
-
Low 3.7
ecdsa Denial of Service vulnerability in signature verification and signature malleability
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
-
Medium 5.8
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashe…
-
High 8.4
A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames a…
-
Unscored —
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user co…
-
Unscored —
The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value…
-
Unscored —
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used…
-
Unscored —CVE-2011-4090 Public exploit
Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.
-
Unscored —
A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-…
-
Medium 5.9
OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor
OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow …
-
Medium 5.4
Cisco Unified Communications Domain Manager Persistent Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interfac…
-
Medium 5.8
Cisco Email Security Appliance MP3 Content Filter Bypass Vulnerability
A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation …
-
Medium 5.4CVE-2019-15972 Public exploit
Cisco Unified Communications Manager SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management inter…
-
Medium 6.7
Cisco Unity Express Command Injection Vulnerability
A vulnerability in the CLI of Cisco Unity Express could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. To exploit this vulnerability, an attacker would need valid administrator credentials. The vuln…
-
Medium 5.3
Cisco WebEx Centers Username Enumeration Information Disclosure Vulnerability
A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to guess account usernames. The vulnerability is due to m…
-
Medium 5.8
Cisco Email Security Appliance URL Filtering Bypass Vulnerability
A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to in…
-
Medium 5.3
Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper a…
-
Medium 5.4
Cisco Stealthwatch Enterprise Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. T…
-
Medium 6.5
Cisco DNA Spaces: Connector SQL Injection Vulnerability
A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit …
-
Medium 6.7
Cisco DNA Spaces: Connector Privilege Escalation Vulnerability
A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execu…
-
Medium 6.7
Cisco DNA Spaces: Connector Command Injection Vulnerability
A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient validation of…
-
Medium 5.3
Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability
A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected device. The vulnera…
-
Medium 5.3
Cisco Webex Teams for Windows DLL Hijacking Vulnerability
A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid c…
-
Medium 6.5
Cisco SD-WAN Solution vManage Cross-Site Request Forgery Vulnerability
A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protec…
-
Unscored —
Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw…
-
Unscored —
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This po…
-
Unscored —
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CR…
-
Unscored —
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a cli…
-
Unscored —
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer (a variable ini…
-
Unscored —
Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string l…
-
High 8.8CVE-2019-15271 Exploited
Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an ac…
KEV Jun 8, 2022 -
High 7.7
Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability
A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists due to a failure of the HT…