Archive
5 December 2019
Vulnerabilities first published on this day (UTC), newest first.
47 results · Feed
-
High 8.8
Unrestricted Upload of File with Dangerous Type in Apache Struts2
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, …
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.…
-
Low 3.5
Internal exception message exposure for login action in Sylius
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal sy…
-
High 7.2
Command Injection in strapi
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be execute…
-
Medium 5.3
Potential DOS attack in Puma
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional co…
-
Medium 4.2
Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since N…
-
Unscored —
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. T…
-
Unscored —
A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of se…
-
Unscored —
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. A special…
-
Unscored —
Norton Password Manager, prior to 6.6.2.5, may be susceptible to an information disclosure issue, which is a type of vu…
-
Unscored —
Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, …
-
Unscored —
Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, …
-
Unscored —
Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux all…
-
Unscored —
An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevate…
-
Unscored —
This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on…
-
Unscored —
This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on…
-
Unscored —
This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, …
-
Critical 9.8
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…
KEV Jun 8, 2022 -
Critical 9.8
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…
KEV Jun 8, 2022 -
Critical 9.8
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the…
KEV Jun 8, 2022 -
Critical 9.8
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…
KEV Jun 8, 2022 -
Unscored —
SCEditor 2.1.3 allows XSS.
-
Unscored —
OpenStack nova base images permissions are world readable
-
Low 2.6
Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect a…
-
Medium 4.8
Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized Persisten…
-
Unscored —
-
Unscored —
beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata serv…
-
Medium 6.8
chkstat follows untrusted symbolic links
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkst…
-
Unscored —
Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user …
-
Unscored —
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allo…
-
Unscored —
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for Pres…
-
Unscored —
tls-extra: certificate validation does not check Basic Constraints
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
-
Unscored —
OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS
-
Medium 5.3
Denial of service
Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG…
-
Critical 9.3
Keycloak Authentication Error
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
-
High 7.8
PAN-OS: Custom-role users may escalate privileges
An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.…
-
Unscored —
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which a…
-
Unscored —
fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows …
-
Unscored —
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.