Archive
December 2019
Vulnerabilities first published in this month (UTC), newest first.
1,587 results · Feed
-
Unscored —
An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_init_frame at from…
-
High 7.5
TVT NVMS-1000 devices allow GET /.. Directory Traversal
KEV Nov 3, 2021 -
Unscored —
The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.
-
Unscored —
On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blockin…
-
Unscored —
On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.
-
Unscored —
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).
-
Unscored —
On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).
-
Unscored —
On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via…
-
Unscored —
On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).
-
Unscored —
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Config…
-
Unscored —
hdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as demonstrated by mysofa2json.
-
Unscored —
Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profi…
-
Unscored —
com.proxyman.NSProxy.HelperTool in Privileged Helper Tool in Proxyman for macOS 1.11.0 and earlier allows an attacker t…
-
Unscored —
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__…
-
Unscored —
LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets.
-
Unscored —
In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, …
-
Unscored —
A memory leak was discovered in Mat_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==…
-
Unscored —
An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted …
-
Unscored —
A floating-point exception was discovered in PackLinuxElf::elf_hash in p_lx_elf.cpp in UPX 3.95. The vulnerability caus…
-
Unscored —CVE-2014-6420 Public exploit
Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web s…
-
Unscored —
Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST reques…
-
Unscored —
Multiple stack-based buffer overflows in CFProfile.exe in Toshiba ConfigFree Utility 8.0.38 allow user-assisted attacke…
-
Unscored —CVE-2014-3136 Public exploit
Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote …
-
Unscored —CVE-2014-4550 Scanner template
Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlie…
-
Unscored —CVE-2014-4535 Scanner template
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote …
-
Unscored —CVE-2014-4536 Scanner template
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infus…
-
Unscored —CVE-2014-4558 Scanner template
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earl…
-
Unscored —
Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress…
-
Unscored —CVE-2014-4544 Scanner template
Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote at…
-
Unscored —CVE-2014-4539 Scanner template
Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to …
-
Unscored —
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder p…
-
Unscored —
An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web serve…
-
Unscored —
An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with e…
-
Unscored —CVE-2019-20049 EPSS 13%
An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directo…
-
Unscored —
thttpd 2007 has buffer underflow.
-
Unscored —
Collabtive 1.0 has incorrect access control
-
Unscored —CVE-2013-4985 Public exploit
Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream
-
Unscored —
AVTECH AVN801 DVR has a security bypass via the administration login captcha
-
Unscored —CVE-2014-4592 Scanner template
Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier …
-
Unscored —
Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials