Weekly Vulnerabilities Reports > September 9 to 15, 2019
Overview
402 new vulnerabilities reported during this period, including 39 critical vulnerabilities and 84 high severity vulnerabilities. This weekly summary report vulnerabilities in 443 products from 170 vendors including Microsoft, Gitlab, Debian, Limesurvey, and Canonical. Vulnerabilities are notably categorized as "Cross-site Scripting", "Information Exposure", "Out-of-bounds Write", "SQL Injection", and "Improper Input Validation".
- 348 reported vulnerabilities are remotely exploitables.
- 8 reported vulnerabilities have public exploit available.
- 132 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
- 287 reported vulnerabilities are exploitable by an anonymous user.
- Microsoft has the most reported vulnerabilities, with 80 reported vulnerabilities.
- Microsoft has the most reported critical vulnerabilities, with 15 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
39 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2019-09-13 | CVE-2019-5485 | Gitlabhook Project | OS Command Injection vulnerability in Gitlabhook Project Gitlabhook 0.0.17 NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. | 10.0 |
2019-09-12 | CVE-2019-8070 | Adobe | Use After Free vulnerability in Adobe Flash Player and Flash Player Desktop Runtime Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. | 10.0 |
2019-09-12 | CVE-2019-8069 | Adobe | Origin Validation Error vulnerability in Adobe Flash Player and Flash Player Desktop Runtime Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. | 10.0 |
2019-09-15 | CVE-2019-16335 | Fasterxml Fedoraproject Debian Netapp Redhat Oracle | Deserialization of Untrusted Data vulnerability in multiple products A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. | 9.8 |
2019-09-15 | CVE-2019-14540 | Fasterxml Netapp Fedoraproject Debian Redhat Oracle | Deserialization of Untrusted Data vulnerability in multiple products A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. | 9.8 |
2019-09-14 | CVE-2019-16303 | Jhipster | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Jhipster A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). | 9.8 |
2019-09-13 | CVE-2010-5333 | Integard Home Project Integard PRO Project | Classic Buffer Overflow vulnerability in multiple products The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. | 9.8 |
2019-09-13 | CVE-2016-10954 | Dynamicpress | Unrestricted Upload of File with Dangerous Type vulnerability in Dynamicpress Neosense The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload. | 9.8 |
2019-09-11 | CVE-2019-10074 | Apache | Improper Encoding or Escaping of Output vulnerability in Apache Ofbiz An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. | 9.8 |
2019-09-11 | CVE-2019-0189 | Apache | Deserialization of Untrusted Data vulnerability in Apache Ofbiz The java.io.ObjectInputStream is known to cause Java serialisation issues. | 9.8 |
2019-09-11 | CVE-2018-17200 | Apache | Unspecified vulnerability in Apache Ofbiz The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. | 9.8 |
2019-09-11 | CVE-2019-13473 | Telestar Auna | Use of Hard-coded Credentials vulnerability in multiple products TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have an undocumented TELNET service within the BusyBox subsystem, leading to root access. | 9.8 |
2019-09-10 | CVE-2019-11495 | Couchbase | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Couchbase Server 5.1.1 In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. | 9.8 |
2019-09-09 | CVE-2019-12405 | Apache | Improper Authentication vulnerability in Apache Traffic Control 3.0.0/3.0.1 Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. | 9.8 |
2019-09-09 | CVE-2019-16140 | Isahc Project | Use After Free vulnerability in Isahc Project Isahc 0.1.2 An issue was discovered in the chttp crate before 0.1.3 for Rust. | 9.8 |
2019-09-09 | CVE-2019-16125 | Jobberbase | SQL Injection vulnerability in Jobberbase 2.0 In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection. | 9.8 |
2019-09-09 | CVE-2019-16124 | Youphptube | Missing Authorization vulnerability in Youphptube In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code. | 9.8 |
2019-09-13 | CVE-2019-13364 | Piwigo | Cross-site Scripting vulnerability in Piwigo 2.9.5 admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. | 9.6 |
2019-09-13 | CVE-2019-13363 | Piwigo | Cross-site Scripting vulnerability in Piwigo 2.9.5 admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. | 9.6 |
2019-09-12 | CVE-2019-3638 | Mcafee | Cross-site Scripting vulnerability in Mcafee web Gateway Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully constructed malicious link. | 9.6 |
2019-09-13 | CVE-2018-7081 | Arubanetworks | Improper Input Validation vulnerability in Arubanetworks Arubaos A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. | 9.3 |
2019-09-13 | CVE-2017-18614 | WP Kama | SQL Injection vulnerability in Wp-Kama Kama Click Counter The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. | 9.3 |
2019-09-11 | CVE-2019-1297 | Microsoft | Unspecified vulnerability in Microsoft Excel, Office and Office 365 Proplus A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1291 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1290 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1280 | Microsoft | Link Following vulnerability in Microsoft products A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1250 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1249 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1248 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1247 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1246 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1243 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1242 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1241 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-1240 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-0788 | Microsoft | Unspecified vulnerability in Microsoft Windows 10, Windows 8.1 and Windows RT 8.1 A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. | 9.3 |
2019-09-11 | CVE-2019-0787 | Microsoft | Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. | 9.3 |
2019-09-13 | CVE-2019-5315 | Arubanetworks | OS Command Injection vulnerability in Arubanetworks Arubaos A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the underlying operating system. | 9.0 |
2019-09-09 | CVE-2019-16139 | Compact Arena Project | Out-of-bounds Read vulnerability in Compact Arena Project Compact Arena An issue was discovered in the compact_arena crate before 0.4.0 for Rust. | 9.0 |
84 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2019-09-13 | CVE-2016-10945 | Pagelines | Cross-Site Request Forgery (CSRF) vulnerability in Pagelines 1.1.4 The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF. | 8.8 |
2019-09-12 | CVE-2019-10392 | Jenkins | OS Command Injection vulnerability in Jenkins GIT Client Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection. | 8.8 |
2019-09-12 | CVE-2019-16261 | Tripplite | Improper Authentication vulnerability in Tripplite Pdumh15At Firmware 12.04.0053 Tripp Lite PDUMH15AT 12.04.0053 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. | 8.5 |
2019-09-10 | CVE-2019-12105 | Supervisord | Missing Authentication for Critical Function vulnerability in Supervisord Supervisor In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. | 8.2 |
2019-09-10 | CVE-2019-12943 | Ttlock | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ttlock TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names. | 8.1 |
2019-09-14 | CVE-2019-16294 | Notepad Plus Plus Scintilla | Out-of-bounds Write vulnerability in multiple products SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file. | 7.8 |
2019-09-13 | CVE-2019-11660 | Microfocus | Untrusted Search Path vulnerability in Microfocus Data Protector Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. | 7.8 |
2019-09-13 | CVE-2019-16288 | Tenda | Unspecified vulnerability in Tenda N301 Firmware On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash. | 7.8 |
2019-09-11 | CVE-2019-1253 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. | 7.8 |
2019-09-11 | CVE-2019-1233 | Microsoft | Unspecified vulnerability in Microsoft Exchange Server 2016/2019 A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'. | 7.8 |
2019-09-10 | CVE-2019-11467 | Couchbase | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Couchbase Server 4.6.3/5.5.0 In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. | 7.8 |
2019-09-10 | CVE-2019-0365 | SAP | Unspecified vulnerability in SAP products SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. | 7.8 |
2019-09-09 | CVE-2019-16144 | Generator RS Project | Use of Uninitialized Resource vulnerability in Generator-Rs Project Generator-Rs An issue was discovered in the generator crate before 0.6.18 for Rust. | 7.8 |
2019-09-09 | CVE-2019-16137 | Spin RS Project | Improper Synchronization vulnerability in Spin-Rs Project Spin-Rs An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. | 7.8 |
2019-09-11 | CVE-2019-1300 | Microsoft | Out-of-bounds Write vulnerability in Microsoft Chakracore and Edge A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. | 7.6 |
2019-09-11 | CVE-2019-1298 | Microsoft | Out-of-bounds Write vulnerability in Microsoft Chakracore and Edge A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. | 7.6 |
2019-09-11 | CVE-2019-1237 | Microsoft | Out-of-bounds Write vulnerability in Microsoft Chakracore and Edge A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. | 7.6 |
2019-09-11 | CVE-2019-1236 | Microsoft | Out-of-bounds Write vulnerability in Microsoft products A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. | 7.6 |
2019-09-11 | CVE-2019-1221 | Microsoft | Out-of-bounds Write vulnerability in Microsoft Internet Explorer 11 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. | 7.6 |
2019-09-11 | CVE-2019-1217 | Microsoft | Out-of-bounds Write vulnerability in Microsoft Chakracore and Edge A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. | 7.6 |
2019-09-11 | CVE-2019-1208 | Microsoft | Use After Free vulnerability in Microsoft Internet Explorer 10/11/9 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. | 7.6 |
2019-09-11 | CVE-2019-1138 | Microsoft | Out-of-bounds Write vulnerability in Microsoft Chakracore and Edge A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. | 7.6 |
2019-09-15 | CVE-2019-16319 | Wireshark Opensuse Debian | Infinite Loop vulnerability in multiple products In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. | 7.5 |
2019-09-14 | CVE-2019-16314 | Indexhibit | Improper Input Validation vulnerability in Indexhibit 2.1.5 Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2. | 7.5 |
2019-09-14 | CVE-2019-16309 | Flamecms Project | SQL Injection vulnerability in Flamecms Project Flamecms 3.3.5 FlameCMS 3.3.5 has SQL injection in account/login.php via accountName. | 7.5 |
2019-09-13 | CVE-2019-5484 | Bower | Path Traversal vulnerability in Bower Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted. | 7.5 |
2019-09-13 | CVE-2019-13918 | Siemens | Weak Password Requirements vulnerability in Siemens Sinema Remote Connect Server 1.1/2.0 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). | 7.5 |
2019-09-13 | CVE-2019-13548 | Codesys | Out-of-bounds Write vulnerability in Codesys products CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution. | 7.5 |
2019-09-13 | CVE-2016-10955 | Cysteme | Unrestricted Upload of File with Dangerous Type vulnerability in Cysteme Cysteme-Finder The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking. | 7.5 |
2019-09-13 | CVE-2016-10942 | Podlove | SQL Injection vulnerability in Podlove Podcast Publisher The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF. | 7.5 |
2019-09-12 | CVE-2019-14237 | NXP | Incorrect Authorization vulnerability in NXP products On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution. | 7.5 |
2019-09-12 | CVE-2019-14236 | ST | Incorrect Authorization vulnerability in ST products On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution. | 7.5 |
2019-09-12 | CVE-2019-6005 | Kddi | Unspecified vulnerability in Kddi Smart TV BOX Firmware Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the device without user's intent, such as installing arbitrary software or changing the device settings via Android Debug Bridge port 5555/TCP. | 7.5 |
2019-09-12 | CVE-2019-5956 | Wondercms | Path Traversal vulnerability in Wondercms Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors. | 7.5 |
2019-09-12 | CVE-2019-16257 | Motorola | Unspecified vulnerability in Motorola Firmware Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker. | 7.5 |
2019-09-12 | CVE-2019-16256 | Samsung | Unspecified vulnerability in Samsung Firmware Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker. | 7.5 |
2019-09-11 | CVE-2019-1306 | Microsoft | Improper Input Validation vulnerability in Microsoft Azure Devops Server and Team Foundation Server A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability'. | 7.5 |
2019-09-11 | CVE-2019-16237 | Dino Canonical Fedoraproject Debian | Origin Validation Error vulnerability in multiple products Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. | 7.5 |
2019-09-11 | CVE-2019-16236 | Dino Canonical Fedoraproject Debian | Missing Authorization vulnerability in multiple products Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. | 7.5 |
2019-09-11 | CVE-2019-16235 | Dino Canonical Fedoraproject Debian | Origin Validation Error vulnerability in multiple products Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala. | 7.5 |
2019-09-11 | CVE-2019-3644 | Mcafee | Unspecified vulnerability in Mcafee products McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9517, potentially leading to a denial of service. | 7.5 |
2019-09-11 | CVE-2019-3643 | Mcafee | Unspecified vulnerability in Mcafee products McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9511, potentially leading to a denial of service. | 7.5 |
2019-09-11 | CVE-2019-16227 | PY Lmdb Project | Out-of-bounds Write vulnerability in Py-Lmdb Project Py-Lmdb An issue was discovered in py-lmdb 0.97. | 7.5 |
2019-09-11 | CVE-2019-16225 | PY Lmdb Project | Out-of-bounds Write vulnerability in Py-Lmdb Project Py-Lmdb An issue was discovered in py-lmdb 0.97. | 7.5 |
2019-09-11 | CVE-2019-16224 | PY Lmdb Project | Out-of-bounds Write vulnerability in Py-Lmdb Project Py-Lmdb An issue was discovered in py-lmdb 0.97. | 7.5 |
2019-09-11 | CVE-2019-14724 | Control Webpanel | Authorization Bypass Through User-Controlled Key vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account. | 7.5 |
2019-09-10 | CVE-2019-11669 | Microfocus | Unspecified vulnerability in Microfocus Service Manager 9.60/9.61/9.62 Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. | 7.5 |
2019-09-10 | CVE-2019-11668 | Microfocus | Unspecified vulnerability in Microfocus products HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. | 7.5 |
2019-09-10 | CVE-2019-10256 | Vivotek | Unspecified vulnerability in Vivotek Camera An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found. | 7.5 |
2019-09-10 | CVE-2019-14457 | Vivotek | Classic Buffer Overflow vulnerability in Vivotek Camera VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header. | 7.5 |
2019-09-10 | CVE-2019-3975 | Advantech | Classic Buffer Overflow vulnerability in Advantech Webaccess 8.4.1 Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message. | 7.5 |
2019-09-10 | CVE-2019-15896 | Lifterlms | Improper Privilege Management vulnerability in Lifterlms An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. | 7.5 |
2019-09-10 | CVE-2019-12401 | Apache | XML Entity Expansion vulnerability in Apache Solr Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. | 7.5 |
2019-09-10 | CVE-2017-18605 | Gravitatedesign | Injection vulnerability in Gravitatedesign Gravitate QA Tracker 1.2.1 The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection. | 7.5 |
2019-09-09 | CVE-2019-16192 | Doccms | Unrestricted Upload of File with Dangerous Type vulnerability in Doccms 2016.5.17 upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive. | 7.5 |
2019-09-09 | CVE-2019-16184 | Limesurvey | Improper Neutralization of Formula Elements in a CSV File vulnerability in Limesurvey A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file. | 7.5 |
2019-09-09 | CVE-2019-6960 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 7.5 |
2019-09-09 | CVE-2019-16190 | Dlink | Improper Authentication vulnerability in Dlink products SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication Bypass, as demonstrated by a direct request to folder_view.php or category_view.php. | 7.5 |
2019-09-09 | CVE-2019-16163 | Oniguruma Project Fedoraproject Debian Canonical | Uncontrolled Recursion vulnerability in multiple products Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. | 7.5 |
2019-09-09 | CVE-2019-16159 | NIC Opensuse Fedoraproject Debian | Out-of-bounds Write vulnerability in multiple products BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. | 7.5 |
2019-09-09 | CVE-2019-16114 | Atutor | Incorrect Authorization vulnerability in Atutor In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. | 7.5 |
2019-09-09 | CVE-2019-10665 | Librenms | Injection vulnerability in Librenms An issue was discovered in LibreNMS through 1.47. | 7.5 |
2019-09-09 | CVE-2018-21013 | Upperthemes | Improper Privilege Management vulnerability in Upperthemes Swape 1.1/1.2 The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php. | 7.5 |
2019-09-09 | CVE-2019-16143 | Blake2 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Blake2 Blake2-Rust An issue was discovered in the blake2 crate before 0.8.1 for Rust. | 7.5 |
2019-09-09 | CVE-2019-16142 | Renderdocs RS Project | Improper Input Validation vulnerability in Renderdocs-Rs Project Renderdocs-Rs An issue was discovered in the renderdoc crate before 0.5.0 for Rust. | 7.5 |
2019-09-09 | CVE-2019-16138 | Image RS | Use After Free vulnerability in Image-Rs Image An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. | 7.5 |
2019-09-09 | CVE-2019-16123 | Kartatopia | Path Traversal vulnerability in Kartatopia Piluscart 1.4.0/1.4.1 In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure. | 7.5 |
2019-09-12 | CVE-2019-11774 | Eclipse | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Eclipse OMR Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. | 7.4 |
2019-09-11 | CVE-2019-1303 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1285 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1284 | Microsoft | Unspecified vulnerability in Microsoft Windows 7 and Windows Server 2008 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1272 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system, aka 'Windows ALPC Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1271 | Microsoft | Out-of-bounds Write vulnerability in Microsoft products An elevation of privilege exists in hdAudio.sys which may lead to an out of band write, aka 'Windows Media Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1269 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system, aka 'Windows ALPC Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1268 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege exists when Winlogon does not properly handle file path information, aka 'Winlogon Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1267 | Microsoft | Improper Privilege Management vulnerability in Microsoft products An elevation of privilege vulnerability exists in Microsoft Compatibility Appraiser where a configuration file, with local privileges, is vulnerable to symbolic link and hard link attacks, aka 'Microsoft Compatibility Appraiser Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1256 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1235 | Microsoft | Origin Validation Error vulnerability in Microsoft products An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or commands it receives, aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1215 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-1214 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'. | 7.2 |
2019-09-11 | CVE-2019-11769 | Teamviewer | Insufficiently Protected Credentials vulnerability in Teamviewer 14.2.2558 An issue was discovered in TeamViewer 14.2.2558. | 7.2 |
2019-09-11 | CVE-2019-16098 | MSI | Improper Privilege Management vulnerability in MSI Afterburner 4.6.2.15658 The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. | 7.2 |
2019-09-10 | CVE-2019-0357 | SAP | Unspecified vulnerability in SAP Hana 1.0/2.0 The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges. | 7.2 |
2019-09-09 | CVE-2019-5473 | Gitlab | Improper Authentication vulnerability in Gitlab 12.0.4/12.1.2 An authentication issue was discovered in GitLab that allowed a bypass of email verification. | 7.2 |
241 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2019-09-14 | CVE-2019-16311 | Niushop | Cross-Site Request Forgery (CSRF) vulnerability in Niushop 1.11 NIUSHOP V1.11 has CSRF via search_info to index.php. | 6.8 |
2019-09-14 | CVE-2019-16305 | Mobatek Microsoft | Command Injection vulnerability in Mobatek Mobaxterm 11.1/12.1 In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. | 6.8 |
2019-09-13 | CVE-2016-10949 | Relevanssi | SQL Injection vulnerability in Relevanssi The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization. | 6.8 |
2019-09-13 | CVE-2016-10948 | Post Indexer Project | Improper Input Validation vulnerability in Post Indexer Project Post Indexer The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function. | 6.8 |
2019-09-13 | CVE-2016-10946 | WP D3 Project | Cross-Site Request Forgery (CSRF) vulnerability in Wp-D3 Project Wp-D3 The wp-d3 plugin before 2.4.1 for WordPress has CSRF. | 6.8 |
2019-09-13 | CVE-2019-16277 | Picoc Project | Out-of-bounds Write vulnerability in Picoc Project Picoc 2.1 PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c. | 6.8 |
2019-09-13 | CVE-2016-10944 | Wpmaz | Cross-Site Request Forgery (CSRF) vulnerability in Wpmaz Multisite Post Duplicator The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF. | 6.8 |
2019-09-12 | CVE-2019-8076 | Adobe | Untrusted Search Path vulnerability in Adobe Application Manager 10.0 Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. | 6.8 |
2019-09-12 | CVE-2019-6007 | Linecorp | Integer Overflow or Wraparound vulnerability in Linecorp Apng-Drawable Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute arbitrary code via unspecified vectors. | 6.8 |
2019-09-12 | CVE-2019-5993 | Tipsandtricks HQ | Cross-Site Request Forgery (CSRF) vulnerability in Tipsandtricks-Hq Category Specific RSS Feed Subscription Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. | 6.8 |
2019-09-12 | CVE-2019-5992 | Ultra Prod | Cross-Site Request Forgery (CSRF) vulnerability in Ultra-Prod Wordpress Ultra Simple Paypal Shopping Cart Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. | 6.8 |
2019-09-12 | CVE-2019-5986 | NTT East NTT West | Cross-Site Request Forgery (CSRF) vulnerability in multiple products Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. | 6.8 |
2019-09-11 | CVE-2019-1302 | Microsoft | Improper Input Validation vulnerability in Microsoft Asp.Net Core 2.1/2.2/3.0 An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'. | 6.8 |
2019-09-11 | CVE-2019-1292 | Microsoft | Unspecified vulnerability in Microsoft products A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. | 6.8 |
2019-09-11 | CVE-2019-1264 | Microsoft | Improper Input Validation vulnerability in Microsoft Office, Office 365 Proplus and Project A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'. | 6.8 |
2019-09-11 | CVE-2019-1261 | Microsoft | Cross-Site Request Forgery (CSRF) vulnerability in Microsoft products A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request, aka 'Microsoft SharePoint Spoofing Vulnerability'. | 6.8 |
2019-09-11 | CVE-2019-1259 | Microsoft | Cross-Site Request Forgery (CSRF) vulnerability in Microsoft Sharepoint Foundation 2013 A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request, aka 'Microsoft SharePoint Spoofing Vulnerability'. | 6.8 |
2019-09-11 | CVE-2019-13544 | Deltaww | Out-of-bounds Write vulnerability in Deltaww Tpeditor 1.89/1.90/1.94 Delta Electronics TPEditor, Versions 1.94 and prior. | 6.8 |
2019-09-11 | CVE-2019-13540 | Deltaww | Out-of-bounds Write vulnerability in Deltaww Tpeditor 1.89/1.90/1.94 Delta Electronics TPEditor, Versions 1.94 and prior. | 6.8 |
2019-09-11 | CVE-2019-13536 | Deltaww | Out-of-bounds Write vulnerability in Deltaww Tpeditor 1.89/1.90/1.94 Delta Electronics TPEditor, Versions 1.94 and prior. | 6.8 |
2019-09-10 | CVE-2017-18607 | Theme Fusion | Cross-Site Request Forgery (CSRF) vulnerability in Theme-Fusion Avada The avada theme before 5.1.5 for WordPress has CSRF. | 6.8 |
2019-09-09 | CVE-2019-16174 | Limesurvey | XXE vulnerability in Limesurvey An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity. | 6.8 |
2019-09-09 | CVE-2019-6793 | Gitlab | Server-Side Request Forgery (SSRF) vulnerability in Gitlab An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 6.8 |
2019-09-09 | CVE-2019-10666 | Librenms | Code Injection vulnerability in Librenms An issue was discovered in LibreNMS through 1.47. | 6.8 |
2019-09-14 | CVE-2019-16318 | Pimcore | Unrestricted Upload of File with Dangerous Type vulnerability in Pimcore In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317. | 6.5 |
2019-09-14 | CVE-2019-16317 | Pimcore | Deserialization of Untrusted Data vulnerability in Pimcore In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318. | 6.5 |
2019-09-13 | CVE-2019-16293 | Opmantek | OS Command Injection vulnerability in Opmantek Open-Audit The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field. | 6.5 |
2019-09-13 | CVE-2019-3646 | Mcafee | Untrusted Search Path vulnerability in Mcafee Total Protection 16.0.36/16.0.R18 DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights. | 6.5 |
2019-09-13 | CVE-2019-12922 | Phpmyadmin Fedoraproject | Cross-Site Request Forgery (CSRF) vulnerability in multiple products A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. | 6.5 |
2019-09-13 | CVE-2019-12516 | Slickquiz Project | SQL Injection vulnerability in Slickquiz Project Slickquiz 1.3.7.1 The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI. | 6.5 |
2019-09-13 | CVE-2016-10951 | Firestormplugins | SQL Injection vulnerability in Firestormplugins Fs-Shopping-Cart 2.07.02 The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter. | 6.5 |
2019-09-13 | CVE-2016-10950 | Sirv | SQL Injection vulnerability in Sirv The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter. | 6.5 |
2019-09-13 | CVE-2016-10947 | Post Indexer Project | SQL Injection vulnerability in Post Indexer Project Post Indexer The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin. | 6.5 |
2019-09-13 | CVE-2016-10943 | ZX CSV Upload Project | SQL Injection vulnerability in Zx-Csv-Upload Project Zx-Csv-Upload 1.0 The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter. | 6.5 |
2019-09-13 | CVE-2016-10940 | ZM Gallery Project | SQL Injection vulnerability in Zm-Gallery Project Zm-Gallery 1.0 The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter. | 6.5 |
2019-09-13 | CVE-2016-10939 | Xtremelocator | SQL Injection vulnerability in Xtremelocator 1.5 The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter. | 6.5 |
2019-09-12 | CVE-2019-16275 | W1 FI Debian Canonical | Origin Validation Error vulnerability in multiple products hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. | 6.5 |
2019-09-12 | CVE-2019-13534 | Philips | Download of Code Without Integrity Check vulnerability in Philips products Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). | 6.5 |
2019-09-12 | CVE-2019-13530 | Philips | Use of Hard-coded Credentials vulnerability in Philips products Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). | 6.5 |
2019-09-12 | CVE-2019-11898 | Bosch | Use of Hard-coded Credentials vulnerability in Bosch Access 2.1/3.3/3.7 Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. | 6.5 |
2019-09-12 | CVE-2019-5996 | Panasonic | SQL Injection vulnerability in Panasonic Video Insight VMS 7.3.2.5 SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. | 6.5 |
2019-09-12 | CVE-2019-5991 | Cybozu | SQL Injection vulnerability in Cybozu Garoon SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. | 6.5 |
2019-09-11 | CVE-2019-1296 | Microsoft | Improper Input Validation vulnerability in Microsoft products A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. | 6.5 |
2019-09-11 | CVE-2019-1295 | Microsoft | Improper Input Validation vulnerability in Microsoft products A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. | 6.5 |
2019-09-11 | CVE-2019-1257 | Microsoft | Improper Input Validation vulnerability in Microsoft products A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. | 6.5 |
2019-09-11 | CVE-2019-3760 | Dell | SQL Injection vulnerability in Dell products The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. | 6.5 |
2019-09-10 | CVE-2019-12942 | Ttlock | Missing Authorization vulnerability in Ttlock TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable. | 6.5 |
2019-09-10 | CVE-2019-0355 | SAP | Code Injection vulnerability in SAP Netweaver Application Server Java SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. | 6.5 |
2019-09-10 | CVE-2019-14721 | Control Webpanel | Authorization Bypass Through User-Controlled Key vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account. | 6.5 |
2019-09-10 | CVE-2017-18602 | Ibps Online Exam Project | SQL Injection vulnerability in Ibps Online Exam Project Ibps Online Exam 1.0 The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter. | 6.5 |
2019-09-10 | CVE-2017-18597 | Jtrt Responsive Tables Project | SQL Injection vulnerability in Jtrt Responsive Tables Project Jtrt Responsive Tables The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter. | 6.5 |
2019-09-10 | CVE-2017-18596 | Elementor | Improper Privilege Management vulnerability in Elementor Page Builder The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. | 6.5 |
2019-09-09 | CVE-2019-16186 | Limesurvey | Incorrect Default Permissions vulnerability in Limesurvey In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions. | 6.5 |
2019-09-09 | CVE-2019-16185 | Limesurvey | Incorrect Default Permissions vulnerability in Limesurvey In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions. | 6.5 |
2019-09-09 | CVE-2019-6783 | Gitlab | Path Traversal vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 6.5 |
2019-09-09 | CVE-2019-16168 | Sqlite Netapp Canonical Fedoraproject Debian Tenable Oracle Mcafee | Divide By Zero vulnerability in multiple products In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." | 6.5 |
2019-09-09 | CVE-2019-12463 | Librenms | Injection vulnerability in Librenms 1.50.1/1.51/1.52 An issue was discovered in LibreNMS 1.50.1. | 6.5 |
2019-09-09 | CVE-2019-10671 | Librenms | SQL Injection vulnerability in Librenms An issue was discovered in LibreNMS through 1.47. | 6.5 |
2019-09-09 | CVE-2019-10669 | Librenms | OS Command Injection vulnerability in Librenms An issue was discovered in LibreNMS through 1.47. | 6.5 |
2019-09-09 | CVE-2019-16131 | Phpok | Unrestricted Upload of File with Dangerous Type vulnerability in PHPok Oklite 1.2.25 framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/cache/. | 6.5 |
2019-09-11 | CVE-2019-8451 | Atlassian | Server-Side Request Forgery (SSRF) vulnerability in Atlassian Jira Server The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. | 6.4 |
2019-09-10 | CVE-2019-11496 | Couchbase | Missing Authentication for Critical Function vulnerability in Couchbase Server 4.0.0/4.6.3/5.0.0 In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. | 6.4 |
2019-09-09 | CVE-2019-10668 | Librenms | Missing Authentication for Critical Function vulnerability in Librenms An issue was discovered in LibreNMS through 1.47. | 6.4 |
2019-09-11 | CVE-2019-10073 | Apache | Cross-site Scripting vulnerability in Apache Ofbiz The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. | 6.1 |
2019-09-11 | CVE-2019-16222 | Wordpress Debian | Cross-site Scripting vulnerability in multiple products WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. | 6.1 |
2019-09-11 | CVE-2019-16221 | Wordpress Debian | Cross-site Scripting vulnerability in multiple products WordPress before 5.2.3 allows reflected XSS in the dashboard. | 6.1 |
2019-09-11 | CVE-2019-16220 | Wordpress Debian | Open Redirect vulnerability in multiple products In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. | 6.1 |
2019-09-11 | CVE-2019-16219 | Wordpress Debian | Cross-site Scripting vulnerability in multiple products WordPress before 5.2.3 allows XSS in shortcode previews. | 6.1 |
2019-09-11 | CVE-2019-16218 | Wordpress Debian | Cross-site Scripting vulnerability in multiple products WordPress before 5.2.3 allows XSS in stored comments. | 6.1 |
2019-09-11 | CVE-2019-16217 | Wordpress Debian | Cross-site Scripting vulnerability in multiple products WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | 6.1 |
2019-09-09 | CVE-2018-21012 | Vsourz | Cross-site Scripting vulnerability in Vsourz CF7 Invisible Recaptcha The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS. | 6.1 |
2019-09-09 | CVE-2019-12464 | Librenms | Path Traversal vulnerability in Librenms 1.50.1 An issue was discovered in LibreNMS 1.50.1. | 6.0 |
2019-09-12 | CVE-2019-6009 | SS Proj | Open Redirect vulnerability in Ss-Proj Shirasagi Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
2019-09-12 | CVE-2019-6004 | Fujixerox | Open Redirect vulnerability in Fujixerox products Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
2019-09-12 | CVE-2019-5978 | Cybozu | Open Redirect vulnerability in Cybozu Garoon Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the application 'Scheduler'. | 5.8 |
2019-09-09 | CVE-2019-6795 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 5.8 |
2019-09-12 | CVE-2019-10398 | Jenkins | Insufficiently Protected Credentials vulnerability in Jenkins Beaker Builder Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. | 5.5 |
2019-09-11 | CVE-2019-0928 | Microsoft | Improper Input Validation vulnerability in Microsoft Windows 10 and Windows Server 2016 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. | 5.5 |
2019-09-11 | CVE-2019-15302 | Xwiki | Improper Resource Shutdown or Release vulnerability in Xwiki Cryptpad The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification. | 5.5 |
2019-09-11 | CVE-2019-3759 | Dell | Code Injection vulnerability in Dell products The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. | 5.5 |
2019-09-10 | CVE-2019-0363 | SAP | Unspecified vulnerability in SAP Hana Extended Application Services 1.0 Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrieve information about internal network ports. | 5.5 |
2019-09-09 | CVE-2019-16167 | Sysstat Project Fedoraproject Opensuse Canonical Debian | Integer Overflow or Wraparound vulnerability in multiple products sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c. | 5.5 |
2019-09-09 | CVE-2019-12465 | Librenms | SQL Injection vulnerability in Librenms An issue was discovered in LibreNMS 1.50.1. | 5.5 |
2019-09-09 | CVE-2019-16132 | Phpok | Path Traversal vulnerability in PHPok Oklite 1.2.25 An issue was discovered in OKLite v1.2.25. | 5.5 |
2019-09-13 | CVE-2016-10953 | Headwaythemes | Cross-site Scripting vulnerability in Headwaythemes Headway The Headway theme before 3.8.9 for WordPress has XSS via the license key field. | 5.4 |
2019-09-12 | CVE-2019-10396 | Jenkins | Cross-site Scripting vulnerability in Jenkins Dashboard View Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions. | 5.4 |
2019-09-12 | CVE-2019-10395 | Jenkins | Cross-site Scripting vulnerability in Jenkins Build Environment Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties. | 5.4 |
2019-09-11 | CVE-2019-16223 | Wordpress Debian | Cross-site Scripting vulnerability in multiple products WordPress before 5.2.3 allows XSS in post previews by authenticated users. | 5.4 |
2019-09-10 | CVE-2019-14726 | Control Webpanel | Unspecified vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account. | 5.4 |
2019-09-09 | CVE-2019-16173 | Limesurvey | Cross-site Scripting vulnerability in Limesurvey LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. | 5.4 |
2019-09-09 | CVE-2019-16172 | Limesurvey | Cross-site Scripting vulnerability in Limesurvey LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. | 5.4 |
2019-09-09 | CVE-2019-5471 | Gitlab | Cross-site Scripting vulnerability in Gitlab An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. | 5.4 |
2019-09-09 | CVE-2019-5467 | Gitlab | Cross-site Scripting vulnerability in Gitlab An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. | 5.4 |
2019-09-11 | CVE-2019-14936 | Easyappointments | Unspecified vulnerability in Easyappointments Easy!Appointments 1.3.2 Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). | 5.3 |
2019-09-10 | CVE-2019-1549 | Openssl | Use of Insufficiently Random Values vulnerability in Openssl OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). | 5.3 |
2019-09-09 | CVE-2019-5463 | Gitlab | Missing Authorization vulnerability in Gitlab An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. | 5.3 |
2019-09-15 | CVE-2019-16320 | Cobham | Information Exposure vulnerability in Cobham products Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community. | 5.0 |
2019-09-14 | CVE-2019-16313 | Ifw8 | Use of Hard-coded Credentials vulnerability in Ifw8 products ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code. | 5.0 |
2019-09-13 | CVE-2019-13532 | Codesys | Path Traversal vulnerability in Codesys products CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller. | 5.0 |
2019-09-13 | CVE-2019-10937 | Siemens | Improper Input Validation vulnerability in Siemens Simatic TDC Cp51M1 Firmware A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). | 5.0 |
2019-09-11 | CVE-2019-16250 | Oceanwp | Improper Authentication vulnerability in Oceanwp Ocean Extra includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence. | 5.0 |
2019-09-11 | CVE-2019-16249 | Opencv | Out-of-bounds Read vulnerability in Opencv 4.1.1 OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp. | 5.0 |
2019-09-11 | CVE-2019-5055 | Netgear | NULL Pointer Dereference vulnerability in Netgear Wnr2000 Firmware 1.0.0.70 An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router. | 5.0 |
2019-09-11 | CVE-2019-5054 | Netgear | NULL Pointer Dereference vulnerability in Netgear Wnr2000 Firmware 1.0.0.70 An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) HTTP server. | 5.0 |
2019-09-11 | CVE-2019-1301 | Microsoft | Unspecified vulnerability in Microsoft .Net Core and Powershell Core A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'. | 5.0 |
2019-09-11 | CVE-2019-1265 | Microsoft | Unspecified vulnerability in Microsoft Yammer A security feature bypass vulnerability exists when Microsoft Yammer App for Android fails to apply the correct Intune MAM Policy.This could allow an attacker to perform functions that are restricted by Intune Policy.The security update addresses the vulnerability by correcting the way the policy is applied to Yammer App., aka 'Microsoft Yammer Security Feature Bypass Vulnerability'. | 5.0 |
2019-09-11 | CVE-2019-11777 | Eclipse | Improper Input Validation vulnerability in Eclipse Paho Java Client 1.2.0 In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. | 5.0 |
2019-09-11 | CVE-2019-16228 | PY Lmdb Project | Divide By Zero vulnerability in Py-Lmdb Project Py-Lmdb An issue was discovered in py-lmdb 0.97. | 5.0 |
2019-09-11 | CVE-2019-16226 | PY Lmdb Project | Out-of-bounds Write vulnerability in Py-Lmdb Project Py-Lmdb An issue was discovered in py-lmdb 0.97. | 5.0 |
2019-09-11 | CVE-2019-8449 | Atlassian | Missing Authentication for Critical Function vulnerability in Atlassian Jira The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability. | 5.0 |
2019-09-11 | CVE-2019-14995 | Atlassian | Missing Authorization vulnerability in Atlassian Jira Server The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check. | 5.0 |
2019-09-10 | CVE-2019-12996 | Mendix | Server-Side Request Forgery (SSRF) vulnerability in Mendix In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe. | 5.0 |
2019-09-10 | CVE-2019-11497 | Couchbase | Improper Certificate Validation vulnerability in Couchbase Server 5.0.0 In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. | 5.0 |
2019-09-10 | CVE-2019-11466 | Couchbase | Missing Authentication for Critical Function vulnerability in Couchbase Server 5.5.0/6.0.0 In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. | 5.0 |
2019-09-10 | CVE-2019-11465 | Couchbase | Information Exposure Through Discrepancy vulnerability in Couchbase Server An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. | 5.0 |
2019-09-10 | CVE-2019-0352 | SAP | Information Exposure vulnerability in SAP Businessobjects Business Intelligence Platform 4.10/4.20/4.30 In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout. | 5.0 |
2019-09-10 | CVE-2019-5503 | Netapp | Cleartext Transmission of Sensitive Information vulnerability in Netapp Oncommand Workflow Automation 5.0 OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors. | 5.0 |
2019-09-10 | CVE-2019-16106 | Humanica | Incorrect Default Permissions vulnerability in Humanica Humatrix 1.0.0.681/7.1.0.0.203 The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment_online/personalData/act_acounttab.cfm txtNewUserName and hdNP fields. | 5.0 |
2019-09-10 | CVE-2017-18604 | Sitebuilder Dynamic Components Project | Injection vulnerability in Sitebuilder Dynamic Components Project Sitebuilder Dynamic Components 1.0 The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request. | 5.0 |
2019-09-09 | CVE-2019-16187 | Limesurvey | Incorrect Permission Assignment for Critical Resource vulnerability in Limesurvey Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script. | 5.0 |
2019-09-09 | CVE-2019-16180 | Limesurvey | Information Exposure vulnerability in Limesurvey Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used. | 5.0 |
2019-09-09 | CVE-2019-16179 | Limesurvey | Improper Certificate Validation vulnerability in Limesurvey Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. | 5.0 |
2019-09-09 | CVE-2019-16177 | Limesurvey | Information Exposure vulnerability in Limesurvey In Limesurvey before 3.17.14, the entire database is exposed through browser caching. | 5.0 |
2019-09-09 | CVE-2019-16176 | Limesurvey | Information Exposure vulnerability in Limesurvey A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem. | 5.0 |
2019-09-09 | CVE-2019-6792 | Gitlab | Information Exposure Through an Error Message vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 5.0 |
2019-09-09 | CVE-2019-6788 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 5.0 |
2019-09-09 | CVE-2019-6782 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 5.0 |
2019-09-09 | CVE-2019-11605 | Gitlab | Information Exposure vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. | 5.0 |
2019-09-09 | CVE-2019-5483 | Senecajs | Information Exposure Through an Error Message vulnerability in Senecajs Seneca Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users. | 5.0 |
2019-09-09 | CVE-2019-16162 | K Takata | Out-of-bounds Read vulnerability in K-Takata Onigmo Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c. | 5.0 |
2019-09-09 | CVE-2019-16161 | K Takata | NULL Pointer Dereference vulnerability in K-Takata Onigmo Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c. | 5.0 |
2019-09-09 | CVE-2019-15895 | Search Exclude Project | Missing Authentication for Critical Function vulnerability in Search Exclude Project Search Exclude search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes. | 5.0 |
2019-09-09 | CVE-2019-15639 | Digium | Improper Input Validation vulnerability in Digium Asterisk main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario. | 5.0 |
2019-09-09 | CVE-2019-10667 | Librenms | Information Exposure vulnerability in Librenms An issue was discovered in LibreNMS through 1.47. | 5.0 |
2019-09-09 | CVE-2018-21011 | Wpcharitable | Information Exposure vulnerability in Wpcharitable Charitable The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. | 5.0 |
2019-09-09 | CVE-2019-16141 | Once Cell Project | Improper Input Validation vulnerability in Once Cell Project Once Cell 0.2.6/0.2.7/1.0.0 An issue was discovered in the once_cell crate before 1.0.1 for Rust. | 5.0 |
2019-09-11 | CVE-2019-16234 | Linux Canonical Opensuse | NULL Pointer Dereference vulnerability in multiple products drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. | 4.7 |
2019-09-11 | CVE-2019-16233 | Linux Canonical Opensuse Redhat | NULL Pointer Dereference vulnerability in multiple products drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. | 4.7 |
2019-09-11 | CVE-2019-16231 | Linux Canonical Opensuse Redhat | NULL Pointer Dereference vulnerability in multiple products drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. | 4.7 |
2019-09-11 | CVE-2019-16230 | Linux | NULL Pointer Dereference vulnerability in Linux Kernel 5.2.14 drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. | 4.7 |
2019-09-10 | CVE-2019-1547 | Openssl | Unspecified vulnerability in Openssl Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. | 4.7 |
2019-09-11 | CVE-2019-16247 | Deltaww | Unspecified vulnerability in Deltaww Dcisoft 1.21 Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x000000000000001b. | 4.6 |
2019-09-11 | CVE-2019-1287 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'Windows Network Connectivity Assistant Elevation of Privilege Vulnerability'. | 4.6 |
2019-09-11 | CVE-2019-1278 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. | 4.6 |
2019-09-11 | CVE-2019-1277 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists in Windows Audio Service when a malformed parameter is processed, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. | 4.6 |
2019-09-11 | CVE-2019-1232 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations, aka 'Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability'. | 4.6 |
2019-09-12 | CVE-2019-11773 | Eclipse | Uncontrolled Search Path Element vulnerability in Eclipse OMR Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. | 4.4 |
2019-09-15 | CVE-2019-16332 | API Bearer Auth Project | Cross-site Scripting vulnerability in API Bearer Auth Project API Bearer Auth In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS. | 4.3 |
2019-09-15 | CVE-2019-16321 | Scadabr | Cross-site Scripting vulnerability in Scadabr 1.0Ce/1.1.0 ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO. | 4.3 |
2019-09-14 | CVE-2019-16307 | Fujixerox | Cross-site Scripting vulnerability in Fujixerox Docushare 7.0.0.C1.609 A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKey parameter (deleteWebExMeetingCheck.jsp). | 4.3 |
2019-09-14 | CVE-2019-16312 | S CMS | Cross-site Scripting vulnerability in S-Cms 3.0 s-cms V3.0 has XSS in index.php?type=text via the S_id parameter. | 4.3 |
2019-09-13 | CVE-2019-5314 | Arubanetworks | Injection vulnerability in Arubanetworks Arubaos Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. | 4.3 |
2019-09-13 | CVE-2019-13923 | Siemens | Cross-site Scripting vulnerability in Siemens Ie/Wsn-Pa Link Wirelesshart Gateway Firmware A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). | 4.3 |
2019-09-13 | CVE-2019-13920 | Siemens | Cross-Site Request Forgery (CSRF) vulnerability in Siemens Sinema Remote Connect Server 1.1/2.0 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). | 4.3 |
2019-09-13 | CVE-2019-12517 | Slickquiz Project | Cross-site Scripting vulnerability in Slickquiz Project Slickquiz 1.3.7.1 An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. | 4.3 |
2019-09-13 | CVE-2016-10952 | Quotes Collection Project | Cross-site Scripting vulnerability in Quotes Collection Project Quotes Collection The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. | 4.3 |
2019-09-13 | CVE-2017-18615 | WP Kama | Cross-site Scripting vulnerability in Wp-Kama Kama Click Counter The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. | 4.3 |
2019-09-13 | CVE-2017-18613 | Trust Form Project | Cross-site Scripting vulnerability in Trust Form Project Trust Form 2.0 The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. | 4.3 |
2019-09-13 | CVE-2017-18612 | Netattingo | Cross-site Scripting vulnerability in Netattingo Wp-Whois-Domain 1.0.0 The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. | 4.3 |
2019-09-13 | CVE-2016-10941 | Podlove | Cross-site Scripting vulnerability in Podlove Podcast Publisher The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF. | 4.3 |
2019-09-13 | CVE-2016-10938 | Copy ME Project | Cross-Site Request Forgery (CSRF) vulnerability in Copy-Me Project Copy-Me 1.0.0 The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location. | 4.3 |
2019-09-12 | CVE-2019-6003 | EC Cube | Cross-site Scripting vulnerability in Ec-Cube Amazon PAY 2.12/2.13/2.4.2 Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
2019-09-12 | CVE-2019-5985 | NTT East NTT West | Cross-site Scripting vulnerability in multiple products Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. | 4.3 |
2019-09-12 | CVE-2019-16238 | Afterlogic | Cross-site Scripting vulnerability in Afterlogic Aurora 8.3.9 Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login. | 4.3 |
2019-09-11 | CVE-2019-1299 | Microsoft | Improper Initialization vulnerability in Microsoft Edge An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft Edge based on Edge HTML Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1286 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1266 | Microsoft | Cross-site Scripting vulnerability in Microsoft Exchange Server 2016/2019 A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1263 | Microsoft | Information Exposure vulnerability in Microsoft Excel, Office and Office 365 Proplus An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1252 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1245 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1244 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1231 | Microsoft | Improper Certificate Validation vulnerability in Microsoft Project Rome 1.4.1 An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1220 | Microsoft | Forced Browsing vulnerability in Microsoft Edge and Internet Explorer A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security Feature Bypass Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-1209 | Microsoft | Information Exposure vulnerability in Microsoft Lync 2013 An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'. | 4.3 |
2019-09-11 | CVE-2019-14998 | Atlassian | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira Server The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance. | 4.3 |
2019-09-11 | CVE-2019-14997 | Atlassian | Unspecified vulnerability in Atlassian Jira Server The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN. | 4.3 |
2019-09-11 | CVE-2019-14996 | Atlassian | Cross-site Scripting vulnerability in Atlassian Jira Server The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter. | 4.3 |
2019-09-11 | CVE-2019-14725 | Control Webpanel | Authorization Bypass Through User-Controlled Key vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account. | 4.3 |
2019-09-10 | CVE-2019-11464 | Couchbase | Cross-site Scripting vulnerability in Couchbase Server 5.1.2/5.5.0 Some enterprises require that REST API endpoints include security-related headers in REST responses. | 4.3 |
2019-09-10 | CVE-2019-0361 | SAP | Cross-site Scripting vulnerability in SAP Supplier Relationship Management 3.73/7.31/7.32 SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | 4.3 |
2019-09-10 | CVE-2019-14730 | Control Webpanel | Unspecified vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account. | 4.3 |
2019-09-10 | CVE-2019-14729 | Control Webpanel | Unspecified vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account. | 4.3 |
2019-09-10 | CVE-2019-14728 | Control Webpanel | Unspecified vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an attacker account. | 4.3 |
2019-09-10 | CVE-2019-14727 | Control Webpanel | Unspecified vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account. | 4.3 |
2019-09-10 | CVE-2019-14723 | Control Webpanel | Unspecified vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account. | 4.3 |
2019-09-10 | CVE-2019-14722 | Control Webpanel | Unspecified vulnerability in Control-Webpanel Webpanel 0.9.8.851 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via an attacker account. | 4.3 |
2019-09-10 | CVE-2017-18611 | Magicfields | Cross-site Scripting vulnerability in Magicfields Magic Fields The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. | 4.3 |
2019-09-10 | CVE-2017-18610 | Magicfields | Cross-site Scripting vulnerability in Magicfields Magic Fields The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. | 4.3 |
2019-09-10 | CVE-2017-18609 | Magicfields | Cross-site Scripting vulnerability in Magicfields Magic Fields The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. | 4.3 |
2019-09-10 | CVE-2017-18608 | Spot | Cross-site Scripting vulnerability in Spot Spot.Im Comments The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. | 4.3 |
2019-09-10 | CVE-2017-18606 | Theme Fusion | Cross-site Scripting vulnerability in Theme-Fusion Avada The avada theme before 5.1.5 for WordPress has stored XSS. | 4.3 |
2019-09-10 | CVE-2017-18603 | Postman Smtp Project | Cross-site Scripting vulnerability in Postman-Smtp Project Postman-Smtp 20171004 The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter. | 4.3 |
2019-09-10 | CVE-2017-18599 | Pinfinity Project | Cross-site Scripting vulnerability in Pinfinity Project Pinfinity The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter. | 4.3 |
2019-09-10 | CVE-2017-18598 | Designmodo | Cross-site Scripting vulnerability in Designmodo Qards The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php. | 4.3 |
2019-09-09 | CVE-2019-7176 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. | 4.3 |
2019-09-09 | CVE-2019-16182 | Limesurvey | Cross-site Scripting vulnerability in Limesurvey A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files. | 4.3 |
2019-09-09 | CVE-2019-16175 | Limesurvey | Improper Restriction of Rendered UI Layers or Frames vulnerability in Limesurvey A clickjacking vulnerability was found in Limesurvey before 3.17.14. | 4.3 |
2019-09-09 | CVE-2019-16147 | Liferay | Cross-site Scripting vulnerability in Liferay Portal Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib. | 4.3 |
2019-09-09 | CVE-2019-16145 | Padrinorb | Cross-site Scripting vulnerability in Padrinorb Padrino-Contrib The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption. | 4.3 |
2019-09-09 | CVE-2019-10253 | Teammatesolutions | Cross-Site Request Forgery (CSRF) vulnerability in Teammatesolutions Teammate+ 21.0.0.0 A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). | 4.3 |
2019-09-09 | CVE-2019-6784 | Gitlab | Cross-site Scripting vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.3 |
2019-09-09 | CVE-2019-11547 | Gitlab | Cross-site Scripting vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. | 4.3 |
2019-09-09 | CVE-2019-16166 | GNU | Out-of-bounds Read vulnerability in GNU Cflow 1.5/1.6 GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c. | 4.3 |
2019-09-09 | CVE-2019-16165 | GNU | Use After Free vulnerability in GNU Cflow 1.5/1.6 GNU cflow through 1.6 has a use-after-free in the reference function in parser.c. | 4.3 |
2019-09-09 | CVE-2019-16164 | Myhtml Project | NULL Pointer Dereference vulnerability in Myhtml Project Myhtml MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c. | 4.3 |
2019-09-09 | CVE-2019-10670 | Librenms | Cross-site Scripting vulnerability in Librenms An issue was discovered in LibreNMS through 1.47. | 4.3 |
2019-09-09 | CVE-2019-16148 | Sakailms | Cross-site Scripting vulnerability in Sakailms Sakai Sakai through 12.6 allows XSS via a chat user name. | 4.3 |
2019-09-09 | CVE-2019-16130 | Hgw168Cc | Cross-site Scripting vulnerability in Hgw168Cc Yii-Cms 1.0 YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html. | 4.3 |
2019-09-09 | CVE-2019-16126 | Getgrav | Cross-site Scripting vulnerability in Getgrav Grav CMS Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images. | 4.3 |
2019-09-12 | CVE-2019-10400 | Jenkins | Unspecified vulnerability in Jenkins Script Security A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts. | 4.2 |
2019-09-12 | CVE-2019-10399 | Jenkins | Unspecified vulnerability in Jenkins Script Security A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts. | 4.2 |
2019-09-12 | CVE-2019-10394 | Jenkins | Unspecified vulnerability in Jenkins Script Security A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts. | 4.2 |
2019-09-12 | CVE-2019-10393 | Jenkins | Unspecified vulnerability in Jenkins Script Security A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts. | 4.2 |
2019-09-11 | CVE-2019-16232 | Linux Canonical Opensuse Fedoraproject | NULL Pointer Dereference vulnerability in multiple products drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. | 4.1 |
2019-09-11 | CVE-2019-16229 | Linux Redhat Canonical | NULL Pointer Dereference vulnerability in multiple products drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. | 4.1 |
2019-09-13 | CVE-2019-13922 | Siemens | Missing Encryption of Sensitive Data vulnerability in Siemens Sinema Remote Connect Server A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). | 4.0 |
2019-09-13 | CVE-2019-13919 | Siemens | Unspecified vulnerability in Siemens Sinema Remote Connect Server A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). | 4.0 |
2019-09-12 | CVE-2019-11899 | Bosch | Information Exposure vulnerability in Bosch Access 2.1/3.3/3.7 An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. | 4.0 |
2019-09-12 | CVE-2019-5977 | Cybozu | Injection vulnerability in Cybozu Garoon Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'. | 4.0 |
2019-09-12 | CVE-2019-5976 | Cybozu | Improper Input Validation vulnerability in Cybozu Garoon Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors. | 4.0 |
2019-09-11 | CVE-2019-1260 | Microsoft | Unspecified vulnerability in Microsoft products An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. | 4.0 |
2019-09-11 | CVE-2019-9488 | Trendmicro | XXE vulnerability in Trendmicro Deep Security Manager and vulnerability Protection Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. | 4.0 |
2019-09-10 | CVE-2019-0364 | SAP | Unspecified vulnerability in SAP Hana Extended Application Services 1.0 Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports. | 4.0 |
2019-09-10 | CVE-2019-0356 | SAP | Unspecified vulnerability in SAP Netweaver Process Integration 7.31/7.40/7.50 Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted. | 4.0 |
2019-09-10 | CVE-2019-16202 | Misp | Improper Privilege Management vulnerability in Misp MISP before 2.4.115 allows privilege escalation in certain situations. | 4.0 |
2019-09-09 | CVE-2019-6791 | Gitlab | Improper Preservation of Permissions vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-16183 | Limesurvey | Incorrect Default Permissions vulnerability in Limesurvey In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. | 4.0 |
2019-09-09 | CVE-2019-16181 | Limesurvey | Unspecified vulnerability in Limesurvey In Limesurvey before 3.17.14, admin users can mark other users' notifications as read. | 4.0 |
2019-09-09 | CVE-2019-15297 | Digium | NULL Pointer Dereference vulnerability in Digium Asterisk res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. | 4.0 |
2019-09-09 | CVE-2019-6997 | Gitlab | Improper Privilege Management vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-6996 | Gitlab | Improper Privilege Management vulnerability in Gitlab An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-6995 | Gitlab | Improper Preservation of Permissions vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-6794 | Gitlab | Improper Privilege Management vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-6789 | Gitlab | Improper Privilege Management vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-6786 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-6785 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. | 4.0 |
2019-09-09 | CVE-2019-11549 | Gitlab | Information Exposure Through Log Files vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. | 4.0 |
2019-09-09 | CVE-2019-11545 | Gitlab | Information Exposure vulnerability in Gitlab An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. | 4.0 |
2019-09-09 | CVE-2019-11544 | Gitlab | Unspecified vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. | 4.0 |
2019-09-09 | CVE-2019-5461 | Gitlab | Improper Input Validation vulnerability in Gitlab An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. | 4.0 |
2019-09-09 | CVE-2019-16133 | Weaver | Insufficient Session Expiration vulnerability in Weaver Eteams OA 4.0.34 An issue was discovered in eteams OA v4.0.34. | 4.0 |
38 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2019-09-10 | CVE-2019-1563 | Openssl | Information Exposure Through Discrepancy vulnerability in Openssl In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. | 3.7 |
2019-09-13 | CVE-2019-15031 | Linux Canonical Opensuse Redhat | Information Exposure vulnerability in multiple products In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. | 3.6 |
2019-09-13 | CVE-2019-15030 | Linux Canonical Opensuse Redhat | Missing Authorization vulnerability in multiple products In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. | 3.6 |
2019-09-11 | CVE-2019-1289 | Microsoft | Incorrect Authorization vulnerability in Microsoft products An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permissions, aka 'Windows Update Delivery Optimization Elevation of Privilege Vulnerability'. | 3.6 |
2019-09-11 | CVE-2019-1270 | Microsoft | Improper Privilege Management vulnerability in Microsoft products An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to symbolic link attack, aka 'Microsoft Windows Store Installer Elevation of Privilege Vulnerability'. | 3.6 |
2019-09-15 | CVE-2019-16334 | Bludit | Cross-site Scripting vulnerability in Bludit 3.9.2 In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. | 3.5 |
2019-09-15 | CVE-2019-16333 | GET Simple | Cross-site Scripting vulnerability in Get-Simple Getsimple CMS 3.3.15 GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php. | 3.5 |
2019-09-14 | CVE-2019-16310 | Niushop | Cross-site Scripting vulnerability in Niushop 1.11 NIUSHOP V1.11 has XSS via the index.php?s=/admin URI. | 3.5 |
2019-09-13 | CVE-2019-16289 | Webcraftic | Cross-site Scripting vulnerability in Webcraftic Woody AD Snippets The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. | 3.5 |
2019-09-12 | CVE-2019-5975 | Cybozu | Cross-site Scripting vulnerability in Cybozu Garoon DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | 3.5 |
2019-09-11 | CVE-2019-1305 | Microsoft | Cross-site Scripting vulnerability in Microsoft Azure Devops Server and Team Foundation Server A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. | 3.5 |
2019-09-11 | CVE-2019-1273 | Microsoft | Cross-site Scripting vulnerability in Microsoft products A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error messages, aka 'Active Directory Federation Services XSS Vulnerability'. | 3.5 |
2019-09-11 | CVE-2019-1262 | Microsoft | Cross-site Scripting vulnerability in Microsoft Sharepoint Foundation 2013 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. | 3.5 |
2019-09-11 | CVE-2019-3761 | Dell | Cross-site Scripting vulnerability in Dell products The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. | 3.5 |
2019-09-11 | CVE-2019-8450 | Atlassian | Cross-site Scripting vulnerability in Atlassian Jira Server Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field. | 3.5 |
2019-09-11 | CVE-2019-16193 | Esri | Cross-site Scripting vulnerability in Esri Arcgis Enterprise 10.6.1 In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature. | 3.5 |
2019-09-11 | CVE-2019-16214 | Libra | Unspecified vulnerability in Libra Core Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. | 3.5 |
2019-09-10 | CVE-2017-18601 | Ibps Online Exam Project | Cross-site Scripting vulnerability in Ibps Online Exam Project Ibps Online Exam 1.0 The examapp plugin 1.0 for WordPress has XSS via exam input text fields. | 3.5 |
2019-09-10 | CVE-2017-18600 | Ncrafts | Cross-site Scripting vulnerability in Ncrafts Formcraft The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. | 3.5 |
2019-09-09 | CVE-2019-16178 | Limesurvey | Cross-site Scripting vulnerability in Limesurvey A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page. | 3.5 |
2019-09-09 | CVE-2019-11548 | Gitlab | Cross-site Scripting vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. | 3.5 |
2019-09-09 | CVE-2019-11546 | Gitlab | Race Condition vulnerability in Gitlab An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. | 3.5 |
2019-09-09 | CVE-2019-16146 | Getgophish | Cross-site Scripting vulnerability in Getgophish Gophish Gophish through 0.8.0 allows XSS via a username. | 3.5 |
2019-09-09 | CVE-2018-21014 | Buddyboss | Cross-site Scripting vulnerability in Buddyboss Buddymoss Media The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. | 3.5 |
2019-09-12 | CVE-2019-10397 | Jenkins | Cleartext Transmission of Sensitive Information vulnerability in Jenkins Aqua Security Severless Scanner Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. | 3.1 |
2019-09-11 | CVE-2019-16248 | Telegram | Unspecified vulnerability in Telegram The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. | 2.1 |
2019-09-11 | CVE-2019-1294 | Microsoft | Unspecified vulnerability in Microsoft products A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality, aka 'Windows Secure Boot Security Feature Bypass Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1293 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects in memory, aka 'Windows SMB Client Driver Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1283 | Microsoft | Information Exposure vulnerability in Microsoft Windows 7 and Windows Server 2008 An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1282 | Microsoft | Unspecified vulnerability in Microsoft products An information disclosure exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle sandbox checks, aka 'Windows Common Log File System Driver Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1274 | Microsoft | Improper Initialization vulnerability in Microsoft products An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1254 | Microsoft | Use of Uninitialized Resource vulnerability in Microsoft products An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1251 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1219 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Transaction Manager Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1216 | Microsoft | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-1142 | Microsoft | Path Traversal vulnerability in Microsoft .Net Framework An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of Privilege Vulnerability'. | 2.1 |
2019-09-11 | CVE-2019-3763 | Dell | Information Exposure Through Log Files vulnerability in Dell products The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerability. | 2.1 |
2019-09-10 | CVE-2019-0353 | SAP | Unspecified vulnerability in SAP Business ONE Client 9.2/9.3 Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would otherwise be restricted. | 2.1 |