Archive
11 December 2019
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
High 8.8
An exploitable heap out of bounds write vulnerability exists in the UI tag parsing functionality of the DICOM image for…
-
High 8.8
An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20.0.2019.3.15. A …
-
High 7.5
An exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.s…
-
Critical 9.8
An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, …
-
High 8.1
An exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so…
-
Critical 9.1
An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS liblt…
-
Medium 6.4CVE-2019-7004 Public exploit
Avaya IP Office XSS Vulnerability
A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, i…
-
Unscored —
When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s u…
-
Unscored —
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the in…
-
Unscored —
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the d…
-
Unscored —
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due…
-
Unscored —
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due…
-
Unscored —
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due…
-
Unscored —
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due…
-
Unscored —
Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due…
-
Unscored —
SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vuln…
-
Unscored —
Reliable Controls LicenseManager versions 3.4 and prior may allow an authenticated user to insert malicious code into t…
-
Unscored —
Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be …
-
Unscored —
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to co…
-
Unscored —
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leadin…
-
Unscored —
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed wh…
-
Unscored —
SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive informat…
-
Unscored —
SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; …
-
Unscored —
Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), befor…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaSc…
-
High 7.5
bson-objectid contains Improper input validation
An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it det…
-
Unscored —
An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_…
-
Unscored —
An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and…
-
Unscored —
The Permissions by Term module extends Drupal by functionality for restricting access to single nodes via taxonomy term…
-
Unscored —
Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.
-
Unscored —
This project enables administrators to create modal dialogs. The routes used by the module lacked proper permissions, a…
-
Unscored —CVE-2013-5978 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordP…
-
Unscored —
-
Unscored —
This module extends access handling of Drupal Core's Taxonomy module. The module doesn't sufficiently check, * if a giv…
-
Unscored —
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21…
-
Unscored —CVE-2013-3691 Public exploit
AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL.
-
Unscored —
The Smart Trim module allows site builders additional control with text summary fields. The module doesn't sufficiently…
-
Unscored —
Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV…
-
Unscored —
Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServ…
-
Unscored —
Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors rela…