Archive
2 December 2019
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
Unscored —CVE-2019-19516 Public exploit
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a p…
-
High 7.5
Use of a Broken or Risky Cryptographic Algorithm in Terraform
When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
-
Unscored —
Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to v…
-
High 8.6
Rhn-proxy: rhn-satellite: rhn-proxy: information disclosure via clear-text credential transmission when accessing rhn satellite
A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to information disclosure, where sensitive authentication details are exposed to unauthorized …
-
Unscored —
FreeBSD: Input Validation Flaw allows local users to gain elevated privileges
-
Unscored —
-
Unscored —
-
Unscored —
-
Unscored —CVE-2012-4428 EPSS 10%
openslp: SLPIntersectStringList()' Function has a DoS vulnerability
-
Unscored —
-
Medium 5.9
Path Traversal in Docker
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
-
Unscored —
Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to key…
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) i…
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a…
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an att…
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file under /include/dbconf…
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during instal…
-
Unscored —
Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration …
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) al…
-
Unscored —
An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to exec…
-
Unscored —
Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when re…
-
Unscored —
Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this inform…
-
Unscored —
Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this …
-
Unscored —
Anviz access control devices allow unverified password change which allows remote attackers to change the administrator…
-
Unscored —
Anviz access control devices allow remote attackers to issue commands without a password.
-
Medium 5.3
Validation bypass is possible in Json Pattern Validator
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payl…
-
Unscored —
The Anviz Management System for access control has insufficient logging for device events such as door open requests.
-
Unscored —
Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open …
-
Unscored —
Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could all…
-
Unscored —
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated …
-
Unscored —CVE-2019-19245 Public exploit
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[us…
-
Medium 6.5
Django allows unintended model editing
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with …
-
Unscored —
Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.
-
Medium 4.3
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vend…
-
Unscored —CVE-2019-19493 Public exploit
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, le…
-
Critical 9.8
Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 all…
-
Unscored —
-
Unscored —
LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrat…
-
Unscored —
TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the UR…