Archive
December 2019
Vulnerabilities first published in this month (UTC), newest first.
126 results · Clear filters · Feed
-
Unscored —CVE-2019-6207 Public exploit
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input…
-
Unscored —
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous …
-
Critical 10.0
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…
KEV Nov 3, 2021 -
Unscored —
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
-
Unscored —CVE-2018-1311 Public exploit
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external…
-
Unscored —CVE-2019-19241 Public exploit
In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabil…
-
Critical 9.8CVE-2019-19634 Public exploit
class.upload.php in verot.net omits .pht from the set of dangerous file extensions
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
-
Unscored —CVE-2019-19315 Public exploit
NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Pri…
-
Unscored —CVE-2019-11157 Public exploit
Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially e…
-
Unscored —CVE-2019-19743 Public exploit
On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.
-
Unscored —
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary lo…
-
Unscored —
A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker c…
-
Unscored —
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdeta…
-
Unscored —CVE-2019-19782 Public exploit
The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server.
-
Unscored —CVE-2019-19740 Public exploit
Octeth Oempro 4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.
-
Unscored —CVE-2019-19726 Public exploit
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can b…
-
Medium 6.4CVE-2019-7004 Public exploit
Avaya IP Office XSS Vulnerability
A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, i…
-
Unscored —
Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.
-
Unscored —CVE-2013-5978 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordP…
-
Unscored —CVE-2013-3691 Public exploit
AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL.
-
Critical 9.8
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…
KEV Nov 3, 2021 -
Unscored —CVE-2019-1476 Public exploit
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
-
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Jan 10, 2022 -
Unscored —
A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly…
-
Unscored —CVE-2019-13764 Public exploit
Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit he…
-
Medium 4.4CVE-2019-6192 Public exploit
A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a…
-
Medium 6.1CVE-2014-3656 Public exploit
JBoss KeyCloak Cross-site Scripting Vulnerability
JBoss KeyCloak: XSS in login-status-iframe.html
-
Unscored —CVE-2014-0242 Public exploit
mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive inf…
-
Unscored —CVE-2015-7892 Public exploit
Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used i…
-
Unscored —CVE-2019-19447 Public exploit
In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can le…
-
Critical 9.8
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…
KEV Nov 3, 2021 -
High 8.8
Unrestricted Upload of File with Dangerous Type in Apache Struts2
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
-
High 7.2
Command Injection in strapi
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be execute…
-
Critical 9.8
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…
KEV Jun 8, 2022 -
Critical 9.8
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…
KEV Jun 8, 2022 -
Critical 9.8
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…
KEV Jun 8, 2022 -
Unscored —CVE-2019-19520 Public exploit
xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH envi…
-
Critical 9.8
Remote code execution in verot/class.upload.php
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
-
Medium 5.5
Improper Restriction of XML External Entity Reference in Apache Olingo
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger…
-
Critical 9.8
An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base G…