Archive
4 December 2019
Vulnerabilities first published on this day (UTC), newest first.
38 results · Feed
-
Medium 6.1
In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the so…
-
Unscored —
In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is…
-
Unscored —CVE-2019-19520 Public exploit
xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH envi…
-
Unscored —
libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radi…
-
Unscored —
OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to bec…
-
Unscored —
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation wher…
-
Unscored —
BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious X…
-
Unscored —
An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wa…
-
Unscored —
An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed i…
-
Unscored —
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page req…
-
Unscored —
Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password …
-
Unscored —
admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= …
-
Unscored —
A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and Cat…
-
Critical 9.8
Remote code execution in verot/class.upload.php
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
-
Unscored —
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields th…
-
Unscored —
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, t…
-
High 7.5
Improper input validation in Apache Olingo
The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a Do…
-
Critical 9.8
Deserialization of Untrusted Data in Apache Olingo
Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker'…
-
Medium 5.5
Improper Restriction of XML External Entity Reference in Apache Olingo
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, t…
-
Unscored —
An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vu…
-
Unscored —
This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fi…
-
Unscored —
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To f…
-
Unscored —
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operation…
-
Unscored —
This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerabi…
-
Unscored —
Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue …
-
Unscored —
Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This is…
-
Unscored —
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects foll…
-
Unscored —
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. T…
-
Unscored —
read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.
-
Unscored —
In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaust…
-
Unscored —
In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no ma…
-
Unscored —
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest ob…
-
Unscored —
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image…
-
Unscored —
COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.
-
Critical 9.3
Keycloak Authentication Error
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
-
Unscored —
TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding…