Archive
December 2019
Vulnerabilities first published in this month (UTC), newest first.
99 results · Clear filters · Feed
-
High 8.1
Avira Free Antivirus is proned to a local privilege escalation through the execution of kernel code from a restricted user.
Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user.
-
High 7.5CVE-2019-20149 Public exploit
Validation Bypass in kind-of
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate…
-
High 7.5
Improper Input Validation in Apache Solr
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configse…
KEV Nov 3, 2021 -
High 7.5
TVT NVMS-1000 devices allow GET /.. Directory Traversal
KEV Nov 3, 2021 -
High 7.1
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially cra…
-
High —
HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
### Impact If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. ``` Content-Length: 10 Transfer-Encod…
-
High 8.8
A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenanc…
-
High 7.5
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
-
High 7.4CVE-2019-5108 EPSS 10%
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could expl…
-
High 7.0
Insufficiently Protected Credentials in Apache Tomcat
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man…
-
High 7.5CVE-2019-17563 EPSS 11%
In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical …
-
High 7.1
HTTP Request Smuggling: LF vs CRLF handling in Waitress
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding C…
-
High 7.1
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding sh…
-
High 7.3CVE-2019-19231 Public exploit
An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that …
-
High 8.2
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager …
-
High 8.1
Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 …
-
High 7.5CVE-2019-7483 Exploited
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user …
KEV Mar 28, 2022 -
High 8.2
An issue was discovered in the Outlook add-in in Pronestor Planner before 8.1.77. There is local privilege escalation i…
-
High —
Command Injection in tree-kill
A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
-
High 7.5
Cross-Site Scripting in http_server
A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
-
High 7.5
Singularity insecure permissions
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
-
High 8.7
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Se…
-
High 8.3
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an I…
-
High 7.1
ABB PB610 HMIStudio accepts malicious DLL file in an application
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s c…
-
High 7.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…
KEV Jun 27, 2022 -
High 7.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…
KEV May 23, 2022 -
High 7.8CVE-2019-8526 Exploited
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An a…
KEV Apr 17, 2023 -
High 8.8
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…
KEV May 4, 2022 -
High 7.8CVE-2019-7287 Exploited
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicati…
KEV May 23, 2022 -
High 7.4
An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-…
-
High 7.5
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This v…
KEV Nov 3, 2021 -
High 8.1
TIBCO Spotfire Server Library Vulnerable to Reflected Cross-Site Scripting
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting (XSS) attack. Af…
-
High 7.7
TIBCO Spotfire Web Player Potentially Exposes Credentials For Shared Data Sources
The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to information that can lead to obtaining cr…
-
High 7.6
TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contains a vulnerability that…
-
High 8.8
TYPO3 Insecure Deserialization in Query Generator & Query View
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system ext…
-
High 8.8
Cross-Site Request Forgery in Jenkins Alauda Kubernetes Suport Plugin
A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes…
-
High 8.8
Jenkins Alauda DevOps Pipeline Plugin vulnerable to cross-site request forgery
A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stor…
-
High 7.1
Jenkins Team Concert Plugin cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenk…
-
High 7.1
Jenkins Team Concert Plugin missing permission check
A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials s…
-
High 8.8
Cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin
A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.