Search
Total
17685 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-15058 | 1 Stb Project | 1 Stb | 2020-08-24 | 6.4 MEDIUM | 9.1 CRITICAL |
| stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service. | |||||
| CVE-2019-15064 | 1 Hinet | 2 Gpon, Gpon Firmware | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| HiNet GPON firmware version < I040GWR190731 allows an attacker login to device without any authentication. | |||||
| CVE-2019-15066 | 1 Hinet | 2 Gpon, Gpon Firmware | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 6998. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | |||||
| CVE-2019-15067 | 1 Gigastone | 2 Smart Battery A2-25de, Smart Battery A2-25de Firmware | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page. | |||||
| CVE-2019-15069 | 1 Gigastone | 2 Smart Battery A4, Smart Battery A4 Firmware | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege. | |||||
| CVE-2019-15088 | 1 Prise | 1 Adas | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication. | |||||
| CVE-2019-15102 | 1 Sahipro | 1 Sahi Pro | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authentication mechanism. This allow an attacker to execute an arbitrary script on the remote Sahi Pro server. There is also a password-protected web interface intended for remote access to scripts. This web interface lacks server-side validation, which allows an attacker to create/modify/delete a script remotely without any password. Chaining both of these issues results in remote code execution on the Sahi Pro server. | |||||
| CVE-2019-15106 | 1 Zohocorp | 1 Manageengine Opmanager | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm. | |||||
| CVE-2019-15107 | 1 Webmin | 1 Webmin | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability. | |||||
| CVE-2019-15111 | 1 Wp Front End Profile Project | 1 Wp Front End Profile | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue. | |||||
| CVE-2019-15294 | 1 Gallagher | 1 Command Centre | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor management service is installed, the Windows username and password for this service are logged in cleartext to the Command_centre.log file. | |||||
| CVE-2019-15318 | 1 Yikesinc | 1 Easy Forms For Mailchimp | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. | |||||
| CVE-2019-15319 | 1 Optiontree Project | 1 Optiontree | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. | |||||
| CVE-2019-15320 | 1 Optiontree Project | 1 Optiontree | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. | |||||
| CVE-2019-15321 | 1 Optiontree Project | 1 Optiontree | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. | |||||
| CVE-2019-15322 | 1 Wpmadeasy | 1 Shortcode Factory | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion. | |||||
| CVE-2019-16060 | 1 Airbrake | 1 Airbrake Ruby | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected). | |||||
| CVE-2019-16102 | 1 Silver-peak | 2 Unity Edgeconnect Sd-wan, Unity Edgeconnect Sd-wan Firmware | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity. | |||||
| CVE-2019-16114 | 1 Atutor | 1 Atutor | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to db_host, db_login, db_password, and content_dir) within install/include/step5.php. | |||||
| CVE-2019-16124 | 1 Youphptube | 1 Youphptube | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code. | |||||
| CVE-2019-16184 | 1 Limesurvey | 1 Limesurvey | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file. | |||||
| CVE-2019-16192 | 1 Doccms | 1 Doccms | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive. | |||||
| CVE-2019-16199 | 1 Eq-3 | 4 Homematic Ccu2, Homematic Ccu2 Firmware, Homematic Ccu3 and 1 more | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process. | |||||
| CVE-2019-16256 | 1 Samsung | 2 Samsung, Samsung Firmware | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker. | |||||
| CVE-2019-16257 | 1 Motorola | 2 Motorola, Motorola Firmware | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker. | |||||
| CVE-2019-16272 | 1 Dten | 4 D5, D5 Firmware, D7 and 1 more | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement. | |||||
| CVE-2019-16273 | 1 Dten | 4 D5, D5 Firmware, D7 and 1 more | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading to arbitrary code execution and system administration. Also, this provides a covert ability to capture screen data from the Zoom Client on Windows by executing commands on the Android OS. | |||||
| CVE-2019-16377 | 1 Makandra | 1 Consul | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control. | |||||
| CVE-2019-16382 | 1 Ivanti | 1 Workspace Control | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid. A malicious PowerGrid XML file can then be created, after which the folder is renamed back to its original value. Also, CVE-2018-15591 exploitation can consequently be achieved by using PowerGrid with the /SEE parameter to execute the arbitrary command specified in the XML file. | |||||
| CVE-2019-16399 | 1 Westerndigital | 2 Wd My Book, Wd My Book Firmware | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me. | |||||
| CVE-2019-16649 | 1 Supermicro | 672 A1sa2-2750f, A1sa2-2750f Firmware, A1sai-2550f and 669 more | 2020-08-24 | 5.0 MEDIUM | 10.0 CRITICAL |
| On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC. | |||||
| CVE-2019-16650 | 1 Supermicro | 526 A1sa2-2750f, A1sa2-2750f Firmware, A1sai-2550f and 523 more | 2020-08-24 | 7.5 HIGH | 10.0 CRITICAL |
| On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC. | |||||
| CVE-2019-16872 | 1 Portainer | 1 Portainer | 2020-08-24 | 9.0 HIGH | 9.9 CRITICAL |
| Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). | |||||
| CVE-2019-16885 | 1 Okay-cms | 1 Okaycms | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie price_filter, and second in api/Comparison.php via the cookie comparison. | |||||
| CVE-2019-16894 | 1 Inoideas | 1 Inoerp | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| download.php in inoERP 4.15 allows SQL injection through insecure deserialization. | |||||
| CVE-2019-17059 | 1 Sophos | 2 Cyberoam, Cyberoamos | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary commands via the Web Admin and SSL VPN consoles. | |||||
| CVE-2019-17184 | 1 Xerox | 11 Atlalink B8045, Atlalink B8055, Atlalink B8065 and 8 more | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker to gain privileges. | |||||
| CVE-2019-17212 | 1 Mbed | 1 Mbed | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated. | |||||
| CVE-2019-17215 | 1 Vzug | 2 Combi-stream Mslq, Combi-stream Mslq Firmware | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) established. An attacker might be able to bruteforce the password to authenticate on the device. | |||||
| CVE-2019-17216 | 1 Vzug | 2 Combi-stream Mslq, Combi-stream Mslq Firmware | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with minimal effort. | |||||
| CVE-2019-17354 | 1 Zyxel | 2 Nbg-418n V2, Nbg-418n V2 Firmware | 2020-08-24 | 7.5 HIGH | 9.4 CRITICAL |
| wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify data fields of the page. | |||||
| CVE-2019-17361 | 3 Debian, Opensuse, Saltstack | 3 Debian Linux, Leap, Salt | 2020-08-24 | 6.8 MEDIUM | 9.8 CRITICAL |
| In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. | |||||
| CVE-2019-17373 | 1 Netgear | 20 Dgn2200, Dgn2200 Firmware, Dgn2200m and 17 more | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2. | |||||
| CVE-2019-17506 | 1 Dlink | 4 Dir-817lw A1, Dir-817lw A1 Firmware, Dir-868l B1 and 1 more | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely. | |||||
| CVE-2019-17512 | 1 Dlink | 2 Dir-412, Dir-412 Firmware | 2020-08-24 | 6.4 MEDIUM | 9.1 CRITICAL |
| There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to log_clear.php, which could be used to erase attack traces. | |||||
| CVE-2019-17526 | 1 Sagemath | 1 Sagemathcell | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| ** DISPUTED ** An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an __import__('os').popen('whoami').read() line. NOTE: the vendor's position is that the product is "vulnerable by design" and the current behavior will be retained. | |||||
| CVE-2019-17601 | 1 Minishare Project | 1 Minishare | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19862 and CVE-2018-19861. NOTE: this product is discontinued. | |||||
| CVE-2019-17662 | 1 Cybelsoft | 1 Thinvnc | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector. | |||||
| CVE-2019-18200 | 1 Fujitsu | 2 Lx390, Lx390 Firmware | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, they are prone to keystroke injection attacks. | |||||
| CVE-2019-18225 | 1 Citrix | 6 Application Delivery Controller, Application Delivery Controller Firmware, Gateway and 3 more | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway before 10.5 build 70.8, 11.x before 11.1 build 63.9, 12.0 before build 62.10, 12.1 before build 54.16, and 13.0 before build 41.28. An attacker with management-interface access can bypass authentication to obtain appliance administrative access. These products formerly used the NetScaler brand name. | |||||