9 December 2019

27 results · Feed

• High 8.1
  CVE-2019-4621

  IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account th…

  IBM DataPower Gateway
  Dec 9, 2019
• Medium 5.4
  CVE-2019-4611

  IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…

  IBM Planning Analytics
  Dec 9, 2019
• Medium 6.3
  CVE-2019-4612

  IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of t…

  IBM Planning Analytics
  Dec 9, 2019
• Medium 5.4
  CVE-2019-4428

  IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnera…

  IBM Watson Assistant for IBM Cloud Pak for Data
  Dec 9, 2019
• Medium 4.3
  CVE-2013-0342

  pyrad uses sequential packet IDs

  The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.

  pyrad pyrad pyrad pyrad Debian Ubuntu PyPI
  Dec 9, 2019
• Critical 9.8
  CVE-2019-19230

  An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component t…

  CA Technologies, A Broadcom Company CA Release Automation
  Dec 9, 2019
• Unscored —
  CVE-2014-0242 Public exploit

  mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive inf…

  mod_wsgi mod_wsgi mod-wsgi Debian
  Dec 9, 2019
• Unscored —
  CVE-2015-7892 Public exploit

  Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used i…

  Dec 9, 2019
• Unscored —
  CVE-2015-3424

  SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote …

  Dec 9, 2019
• Unscored —
  CVE-2015-3425

  Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allow…

  Dec 9, 2019
• Unscored —
  CVE-2015-1853

  chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allow…

  Chrony Chrony chrony chrony Debian Ubuntu
  Dec 9, 2019
• Unscored —
  CVE-2019-18190

  Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors re…

  Trend Micro Trend Micro Security (Consumer)
  Dec 9, 2019
• Unscored —
  CVE-2015-0841

  Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote atta…

  monopd monopd monopd Debian
  Dec 9, 2019
• Unscored —
  CVE-2019-19603 EPSS 11%

  SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

  sqlite3 sqlite3 Debian Ubuntu
  Dec 9, 2019
• Unscored —
  CVE-2019-19646

  pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generate…

  ceph Azure Linux
  Dec 9, 2019
• Unscored —
  CVE-2019-18380

  Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issu…

  Symantec Industrial Control System Protection (ICSP)
  Dec 9, 2019
• High 8.8
  CVE-2019-19687

  OpenStack Keystone Credential Leakage

  OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able t…

  keystone keystone Debian PyPI
  Dec 9, 2019
• Unscored —
  CVE-2019-19682

  nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Contro…

  Dec 9, 2019
• Unscored —
  CVE-2019-19684

  nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginCo…

  Dec 9, 2019
• Unscored —
  CVE-2019-19685

  RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and…

  Dec 9, 2019
• Unscored —
  CVE-2019-19683

  RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/Pr…

  Dec 9, 2019
• Unscored —
  CVE-2019-14251 Scanner template

  An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a doc…

  Dec 9, 2019
• Unscored —
  CVE-2019-19678

  In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic …

  Dec 9, 2019
• Unscored —
  CVE-2019-19679

  In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Cond…

  Dec 9, 2019
• Unscored —
  CVE-2019-19645

  alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential v…

  sqlite3 sqlite3 ceph Debian Ubuntu Azure Linux
  Dec 9, 2019
• Unscored —
  CVE-2019-19648

  In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real s…

  yara yara Debian Ubuntu
  Dec 9, 2019
• Unscored —
  CVE-2019-19647

  radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, u…

  radare2 radare2 Ubuntu Alpine
  Dec 9, 2019