Archive
11 December 2019
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet a…
-
Unscored —
wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote att…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possi…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerat…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging r…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-b…
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) …
-
Unscored —
An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest O…
-
Unscored —
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which …
-
Unscored —
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a typ…
-
Unscored —
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a typ…
-
Unscored —
Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.
-
Medium 6.1
Sanitizer bypass in svg-sanitizer
It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
-
High 7.4
A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point…
-
Unscored —
The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attacke…
-
Unscored —
The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attac…
-
Unscored —
The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary …
-
High 8.8
IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system.…
-
Medium 5.4
IBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar…
-
Unscored —
Foreman has improper input validation which could lead to partial Denial of Service
-
Unscored —
-
Medium 6.1
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
-
Low —
methodOverride Middleware Reflected Cross-Site Scripting in connect
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
-
Unscored —
-
High 7.5
omniauth-facebook Improper Authentication vulnerability
RubyGem omniauth-facebook has an access token security vulnerability
-
Unscored —
Orca has arbitrary code execution due to insecure Python module load
-
Unscored —
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
-
Unscored —
Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploita…
-
Medium 6.6
DLL Search Order Hijacking
DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker.
-
Unscored —
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
-
Unscored —CVE-2019-19719 EPSS 22%
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
-
Unscored —
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-v…
-
Medium 6.1
Possible to circumvent title-blacklist
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.
-
Unscored —
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFIN…
-
High 7.5
Nokogiri implementation of libxslt vulnerable to heap corruption
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.
-
Critical 9.8
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…
KEV Nov 3, 2021 -
Unscored —
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.