Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-5977 | 1 Cybozu | 1 Garoon | 2019-09-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'. | |||||
| CVE-2019-5976 | 1 Cybozu | 1 Garoon | 2019-09-13 | 4.0 MEDIUM | 4.9 MEDIUM |
| Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors. | |||||
| CVE-2019-1305 | 1 Microsoft | 2 Azure Devops Server, Team Foundation Server | 2019-09-13 | 3.5 LOW | 5.4 MEDIUM |
| A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. | |||||
| CVE-2019-6009 | 1 Ss-proj | 1 Shirasagi | 2019-09-13 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | |||||
| CVE-2019-16172 | 1 Limesurvey | 1 Limesurvey | 2019-09-12 | 3.5 LOW | 5.4 MEDIUM |
| LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion. | |||||
| CVE-2019-16173 | 1 Limesurvey | 1 Limesurvey | 2019-09-12 | 3.5 LOW | 5.4 MEDIUM |
| LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php, | |||||
| CVE-2019-16193 | 1 Esri | 1 Arcgis Enterprise | 2019-09-12 | 3.5 LOW | 5.4 MEDIUM |
| In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature. | |||||
| CVE-2019-14725 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-09-12 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account. | |||||
| CVE-2019-14721 | 1 Centos-webpanel | 1 Centos Web Panel | 2019-09-12 | 5.5 MEDIUM | 6.5 MEDIUM |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account. | |||||
| CVE-2019-0928 | 1 Microsoft | 2 Windows 10, Windows Server 2016 | 2019-09-12 | 5.5 MEDIUM | 6.2 MEDIUM |
| A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. | |||||
| CVE-2017-18603 | 1 Postman-smtp Project | 1 Postman-smtp | 2019-09-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter. | |||||
| CVE-2019-1283 | 1 Microsoft | 2 Windows 7, Windows Server 2008 | 2019-09-12 | 2.1 LOW | 5.5 MEDIUM |
| An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'. | |||||
| CVE-2019-1293 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2019-09-12 | 2.1 LOW | 5.5 MEDIUM |
| An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects in memory, aka 'Windows SMB Client Driver Information Disclosure Vulnerability'. | |||||
| CVE-2018-18056 | 1 Ti | 4 Tm4c123, Tm4c123 Firmware, Tm4c129 and 1 more | 2019-09-12 | 2.1 LOW | 4.6 MEDIUM |
| An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory (XOM) implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in XOM-protected flash memory. As a consequence, it is possible to execute single instructions with arbitrary system states (e.g., registers, status flags, and SRAM content) and observe the state changes produced by the unknown instruction. An attacker could exploit this vulnerability by executing protected and unknown instructions with specific system states and observing the state changes. Based on the gathered information, it is possible to reverse-engineer the executed instructions. The processor acts as a kind of "instruction oracle." | |||||
| CVE-2019-1251 | 1 Microsoft | 3 Windows 10, Windows Server 2016, Windows Server 2019 | 2019-09-12 | 2.1 LOW | 5.5 MEDIUM |
| An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1244, CVE-2019-1245. | |||||
| CVE-2019-1219 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2019-09-12 | 2.1 LOW | 5.5 MEDIUM |
| An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Transaction Manager Information Disclosure Vulnerability'. | |||||
| CVE-2019-1252 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2019-09-12 | 4.3 MEDIUM | 6.5 MEDIUM |
| An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1286. | |||||
| CVE-2019-1245 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2019-09-12 | 4.3 MEDIUM | 6.5 MEDIUM |
| An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1244, CVE-2019-1251. | |||||
| CVE-2019-1286 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2019-09-12 | 4.3 MEDIUM | 6.5 MEDIUM |
| An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1252. | |||||
| CVE-2019-1244 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2019-09-12 | 4.3 MEDIUM | 6.5 MEDIUM |
| An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1245, CVE-2019-1251. | |||||
| CVE-2019-1231 | 1 Microsoft | 1 Project Rome | 2019-09-12 | 4.3 MEDIUM | 5.9 MEDIUM |
| An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'. | |||||
| CVE-2019-1216 | 1 Microsoft | 7 Windows 10, Windows 7, Windows 8.1 and 4 more | 2019-09-12 | 2.1 LOW | 5.5 MEDIUM |
| An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. | |||||
| CVE-2019-1209 | 1 Microsoft | 1 Lync | 2019-09-12 | 4.3 MEDIUM | 6.5 MEDIUM |
| An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'. | |||||
| CVE-2019-1273 | 1 Microsoft | 3 Windows 10, Windows Server 2016, Windows Server 2019 | 2019-09-12 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error messages, aka 'Active Directory Federation Services XSS Vulnerability'. | |||||
| CVE-2019-8451 | 1 Atlassian | 1 Jira | 2019-09-12 | 6.4 MEDIUM | 6.5 MEDIUM |
| The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. | |||||
| CVE-2019-16221 | 1 Wordpress | 1 Wordpress | 2019-09-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| WordPress before 5.2.3 allows reflected XSS in the dashboard. | |||||
| CVE-2019-16220 | 1 Wordpress | 1 Wordpress | 2019-09-12 | 5.8 MEDIUM | 6.1 MEDIUM |
| In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect. | |||||
| CVE-2019-16219 | 1 Wordpress | 1 Wordpress | 2019-09-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| WordPress before 5.2.3 allows XSS in shortcode previews. | |||||
| CVE-2019-16222 | 1 Wordpress | 1 Wordpress | 2019-09-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. | |||||
| CVE-2018-16425 | 1 Opensc Project | 1 Opensc | 2019-09-11 | 4.6 MEDIUM | 6.6 MEDIUM |
| A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. | |||||
| CVE-2018-16424 | 1 Opensc Project | 1 Opensc | 2019-09-11 | 4.6 MEDIUM | 6.6 MEDIUM |
| A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. | |||||
| CVE-2019-8450 | 1 Atlassian | 1 Jira | 2019-09-11 | 3.5 LOW | 4.8 MEDIUM |
| Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field. | |||||
| CVE-2019-14996 | 1 Atlassian | 1 Jira | 2019-09-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter. | |||||
| CVE-2019-16202 | 1 Misp | 1 Misp | 2019-09-11 | 4.0 MEDIUM | 6.5 MEDIUM |
| MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message. | |||||
| CVE-2018-6806 | 1 Marked 2 Project | 1 Marked 2 | 2019-09-11 | 4.3 MEDIUM | 6.5 MEDIUM |
| Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls. | |||||
| CVE-2019-12996 | 1 Mendix | 1 Mendix | 2019-09-11 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe. | |||||
| CVE-2019-16145 | 1 Padrinorb | 1 Padrino-contrib | 2019-09-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption. | |||||
| CVE-2019-0361 | 1 Sap | 1 Supplier Relationship Management | 2019-09-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2018-20551 | 2 Canonical, Freedesktop | 2 Ubuntu Linux, Poppler | 2019-09-11 | 4.3 MEDIUM | 6.5 MEDIUM |
| A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c. | |||||
| CVE-2019-10253 | 1 Teammatesolutions | 1 Teammate\+ | 2019-09-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request. | |||||
| CVE-2019-11545 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue. | |||||
| CVE-2019-11546 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 3.5 LOW | 5.3 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge. | |||||
| CVE-2019-11548 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint. | |||||
| CVE-2017-18610 | 1 Magicfields | 1 Magic Fields | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. | |||||
| CVE-2017-18611 | 1 Magicfields | 1 Magic Fields | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. | |||||
| CVE-2017-18601 | 1 Ibps Online Exam Project | 1 Ibps Online Exam | 2019-09-10 | 3.5 LOW | 5.4 MEDIUM |
| The examapp plugin 1.0 for WordPress has XSS via exam input text fields. | |||||
| CVE-2017-18606 | 1 Theme-fusion | 1 Avada | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The avada theme before 5.1.5 for WordPress has stored XSS. | |||||
| CVE-2017-18600 | 1 Ncrafts | 1 Formcraft | 2019-09-10 | 3.5 LOW | 5.4 MEDIUM |
| The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. | |||||
| CVE-2019-16175 | 1 Limesurvey | 1 Limesurvey | 2019-09-10 | 4.3 MEDIUM | 4.3 MEDIUM |
| A clickjacking vulnerability was found in Limesurvey before 3.17.14. | |||||
| CVE-2019-6784 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS. | |||||