Archive
December 2019
Vulnerabilities first published in this month (UTC), newest first.
1,587 results · Feed
-
Unscored —CVE-2015-5595 Public exploit
Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack…
-
Unscored —
The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attacke…
-
Unscored —
Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scriptin…
-
Unscored —CVE-2015-5591 Public exploit
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
-
Unscored —
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stac…
-
Unscored —
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, perf…
-
Unscored —
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, perf…
-
Unscored —
An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an…
-
Unscored —
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use realloc on a block…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the handle_request function in lib/HTTPServer.pm in Monitorix before 3.4.0 …
-
Unscored —
The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary…
-
Unscored —
go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query …
-
Unscored —
Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a d…
-
High 8.1
Avira Free Antivirus is proned to a local privilege escalation through the execution of kernel code from a restricted user.
Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user.
-
Unscored —
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id p…
-
Unscored —
The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to caus…
-
Unscored —
gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it …
-
Unscored —
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due…
-
Unscored —CVE-2019-10227 Public exploit
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
-
Unscored —
The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote…
-
Unscored —
The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered…
-
Unscored —
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, fo…
-
Unscored —
The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.
-
Unscored —
PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. NOTE: This product is discontinue…
-
Unscored —
PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This produc…
-
Medium 6.1CVE-2019-9553 Public exploit
Bolt Cross-site Scripting via the slug, teaser or title parameters
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.
-
Unscored —CVE-2019-9554 Public exploit
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code a…
-
Unscored —CVE-2019-9556 Public exploit
FiberHome an5506-04-f RP2669 devices have XSS.
-
Unscored —
An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remot…
-
Unscored —
GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.
-
Unscored —
The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to ch…
-
Unscored —
The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token…
-
Unscored —
The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, …
-
Unscored —
The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable…
-
Unscored —
The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows atta…
-
Unscored —
An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the dir…
-
Medium 4.8
XSS injection in the Grid component of Sylius
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18,…
-
Unscored —
OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE…
-
Unscored —
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenti…
-
Unscored —CVE-2019-20176 Scanner template
In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.