Archive
December 2019
Vulnerabilities first published in this month (UTC), newest first.
1,587 results · Feed
-
Unscored —
An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses t…
-
Unscored —
In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue t…
-
Unscored —
In libIEC61850 1.4.0, getNumberOfElements in mms/iso_mms/server/mms_access_result.c has an out-of-bounds read vulnerabi…
-
Critical 9.9
Remote Code Execution Vulnerability in NPM mongo-express
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
KEV Dec 10, 2021 -
Unscored —
NVIDIA GeForce Experience, all versions prior to 3.20.2, contains a vulnerability when GameStream is enabled in which a…
-
Unscored —
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
-
Unscored —CVE-2019-19924 EPSS 11%
SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by i…
-
Unscored —
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which …
-
High 7.5
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
-
Unscored —
Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 (Firmware versions prior to 8.26.4), may allow attacke…
-
Unscored —
Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\…
-
Unscored —CVE-2017-16778 Public exploit
An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual…
-
Unscored —
A privilege escalation vulnerability in Trend Micro Antivirus for Mac 2019 (v9.0.1379 and below) could potentially allo…
-
Unscored —
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.
-
Unscored —
In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of mag…
-
Unscored —
In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of co…
-
Unscored —
In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coder…
-
Unscored —
In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to …
-
Unscored —
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, rela…
-
Unscored —
In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/n…
-
Unscored —
Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attack…
-
Unscored —
Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attack…
-
Unscored —
Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perfo…
-
Unscored —CVE-2018-10388 Public exploit
Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perfo…
-
Unscored —
Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of ser…
-
Unscored —
An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to u…
-
Unscored —CVE-2019-7489 Public exploit
A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. T…
-
Unscored —
Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to …
-
Unscored —
Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root all…
-
Unscored —
Multiple buffer overflow vulnerabilities exist when the PLC Editor Version 1.3.5_20190129 processes project files. An a…
-
Unscored —
VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) cont…
-
Unscored —
Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific…
-
High 7.4CVE-2019-5108 EPSS 10%
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could expl…
-
Unscored —
In libIEC61850 1.4.0, BerDecoder_decodeUint32 in mms/asn1/ber_decode.c has an out-of-bounds read, related to intLen and…
-
Unscored —
Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely …
-
Unscored —
A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that …
-
Unscored —
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers …
-
Unscored —
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability. Atta…
-
Unscored —
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could…
-
Unscored —
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.2…