Archive
18 December 2019
Vulnerabilities first published on this day (UTC), newest first.
369 results · Feed
-
High 7.5
Cross-Site Scripting in http_server
A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
-
High 7.5
Singularity insecure permissions
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
-
Unscored —
An exploitable denial of service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 …
-
Unscored —
An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 …
-
Unscored —
An exploitable information exposure vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC2…
-
Unscored —
An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and depen…
-
High 8.7
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Se…
-
High 8.3
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an I…
-
Medium 5.4
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a re…
-
Unscored —
An exploitable denial-of-service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200…
-
Unscored —
An exploitable heap buffer overflow vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC2…
-
High 7.1
ABB PB610 HMIStudio accepts malicious DLL file in an application
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s c…
-
Medium 4.3
PB610 HMISimulator provides interface with access to arbitrary files
The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working dire…
-
Low 3.9
ABB PB610 HMIStudio crashes after launching an empty *.JPR application file
Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty *.JPR application file. An attacker with access to the file system might be able to cause applicatio…
-
Medium 4.3
ABB PB610 HMISimulator does not check content-length of the HTTP request
The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting.
-
Unscored —
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…
-
Unscored —
An exploitable heap buffer overflow vulnerability exists in the iocheckd service ''I/O-Chec'' functionality of WAGO PFC…
-
Unscored —
An exploitable denial-of-service vulnerability exists in the iocheckd service ‘’I/O-Chec’’ functionality of WAGO PFC 20…
-
Unscored —
Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visua…
-
Unscored —
Security vulnerabilities in HPE UIoT version 1.2.4.2 could allow unauthorized remote access and access to sensitive dat…
-
Unscored —
An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An at…
-
Unscored —
An exploitable stack buffer overflow vulnerability exists in the iocheckd service ''I/O-Check'' functionality of WAGO P…
-
Medium 6.3
Possible Information Leak / Session Hijack Vulnerability in Rack
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session …
-
Unscored —
An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over…
-
Unscored —
An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The attacker can discover admin…
-
Unscored —
bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.
-
Unscored —
jfif_decode in jfif.c in ffjpeg through 2019-08-21 has a divide-by-zero error.
-
Unscored —
The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has re…
-
Unscored —
Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vu…
-
Unscored —
Trend Micro Mobile Security for Android (Consumer) versions 10.3.1 and below on Android 8.0+ has an issue in which an a…
-
Unscored —
A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be ex…
-
Unscored —
The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in…
-
Unscored —
An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote att…
-
Unscored —
Drupal 8 core's `file_save_upload()` function does not strip the leading and trailing dot ('.') from filenames, like Dr…
-
Critical 9.8
Django Potential account hijack via password reset form
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…
-
Unscored —
A visit to `install.php` can cause cached data to become corrupted. This could cause a site to be impaired until caches…
-
Unscored —
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security …
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2,…
-
Unscored —
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, mac…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…