Archive
9 January 2020
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
High 8.3
A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to …
-
Unscored —
LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the…
-
Critical 9.8
languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to r…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KD…
-
High 7.4
contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers …
-
High 8.8
phpMyAdmin SQL injection in user accounts page
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access …
-
Unscored —CVE-2012-3810 Public exploit
Samsung Kies before 2.5.0.12094_27_11 has registry modification.
-
Unscored —CVE-2012-3809 Public exploit
Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
-
Unscored —CVE-2012-3808 Public exploit
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
-
Unscored —
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.
-
Unscored —
Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attack…
-
Unscored —
Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.
-
Unscored —
SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.
-
Unscored —CVE-2019-20183 Scanner template
uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension…
-
Unscored —
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
-
Unscored —
KeePass 2.4.1 allows CSV injection in the title field of a CSV export.
-
Unscored —
Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote at…
-
Unscored —
The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
-
Unscored —
PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arb…
-
Unscored —
389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, wh…
-
Unscored —
The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-…
-
Unscored —
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute ar…
-
Unscored —
The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function …
-
Unscored —CVE-2012-2226 Public exploit
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain se…
-
Unscored —CVE-2012-1915 Public exploit
EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
-
Unscored —CVE-2019-18859 Public exploit
Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.
-
Unscored —
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the abil…
-
High 7.6
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with ba…
-
Unscored —
The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authenti…
-
Medium 5.4
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with ba…
-
Unscored —
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal …
-
Unscored —CVE-2012-1261 Public exploit
Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow…
-
Unscored —CVE-2012-1260 Public exploit
Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow A…
-
Unscored —CVE-2012-1259 Public exploit
Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and po…
-
Unscored —CVE-2012-1258 Public exploit
cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate…
-
Unscored —
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security…
-
Unscored —
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting …
-
Unscored —
HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firm…
-
Unscored —
Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F2…