Archive
26 December 2019
Vulnerabilities first published on this day (UTC), newest first.
73 results · Feed
-
Unscored —
Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging".
-
Unscored —
In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an exi…
-
Unscored —
An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2.
-
Unscored —
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, perf…
-
Unscored —
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content puts a pointer to the internal ad…
-
Unscored —
An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted XML file, pe…
-
Unscored —
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attac…
-
Medium 5.4
Features file injection vulnerability
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.
-
Unscored —
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provi…
-
Unscored —
A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler.
-
Unscored —
JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.
-
Unscored —
A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing …
-
Unscored —
In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an …
-
Unscored —
USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. Due to a flaw in the X.509 imp…
-
Unscored —
A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.pa…
-
Unscored —
USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. Due to a flaw in the X.509 imp…
-
Unscored —
USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. Due to a flaw in the X.509 imp…
-
Unscored —
USG9500 with versions of V500R001C30;V500R001C60 have a missing integrity checking vulnerability. The software of the a…
-
Unscored —
M5 lite 10 with versions of 8.0.0.182(C00) have an insufficient input validation vulnerability. Due to the input valida…
-
Unscored —
An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. A malformed login request allows remote attackers to caus…
-
Unscored —
A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, leading to complete control of the router, as demonst…
-
Unscored —
D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the s…
-
Unscored —
D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit t…
-
Medium 5.8
Stored cross-site scripting (XSS) in WordPress block editor
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
-
Medium 5.8
Stored cross-site scripting (XSS) in WordPress block editor
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x bef…
-
High 7.1
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially cra…
-
High —
HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
### Impact If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. ``` Content-Length: 10 Transfer-Encod…
-
Unscored —
Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert s…
-
Unscored —
TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::read…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack t…
-
Unscored —
Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable …
-
Unscored —
Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbi…
-
Unscored —
DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Lin…
-
Unscored —
REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allow remote attackers to [Disclosed_Information…
-
Unscored —
Cross-site scripting vulnerability in a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), an…
-
Unscored —
DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.
-
Unscored —
Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijac…
-
Unscored —
Privilege escalation vulnerability in Multiple MOTEX products (LanScope Cat client program (MR) and LanScope Cat client…