Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2006-0062 | 1 Sillycycle | 1 Xlockmore | 2019-11-06 | 7.5 HIGH | 9.8 CRITICAL |
| xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window. | |||||
| CVE-2013-4280 | 1 Redhat | 3 Enterprise Virtualization, Storage, Virtual Desktop Server Manager | 2019-11-06 | 2.1 LOW | 5.5 MEDIUM |
| Insecure temporary file vulnerability in RedHat vsdm 4.9.6. | |||||
| CVE-2013-1945 | 1 Ruby-lang | 1 Ruby193 | 2019-11-06 | 2.1 LOW | 3.3 LOW |
| ruby193 uses an insecure LD_LIBRARY_PATH setting. | |||||
| CVE-2019-18674 | 1 Joomla | 1 Joomla\! | 2019-11-06 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure. | |||||
| CVE-2019-18650 | 1 Joomla | 1 Joomla\! | 2019-11-06 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. | |||||
| CVE-2018-1000002 | 1 Nic | 1 Knot Resolver | 2019-11-06 | 4.3 MEDIUM | 3.7 LOW |
| Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay. | |||||
| CVE-2019-15588 | 1 Sonatype | 1 Nexus Repository Manager | 2019-11-06 | 9.0 HIGH | 7.2 HIGH |
| There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability. | |||||
| CVE-2019-8115 | 1 Magento | 1 Magento | 2019-11-06 | 3.5 LOW | 4.8 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation. | |||||
| CVE-2019-8117 | 1 Magento | 1 Magento | 2019-11-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specification. | |||||
| CVE-2019-8120 | 1 Magento | 1 Magento | 2019-11-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address. | |||||
| CVE-2006-4243 | 1 Linux-vserver | 1 Linux-vserver | 2019-11-06 | 10.0 HIGH | 9.8 CRITICAL |
| linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. | |||||
| CVE-2019-18784 | 1 Salesagility | 1 Suitecrm | 2019-11-06 | 7.5 HIGH | 9.8 CRITICAL |
| SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. | |||||
| CVE-2019-18207 | 1 Zucchetti | 1 Infobusiness | 2019-11-06 | 3.5 LOW | 5.4 MEDIUM |
| In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page. | |||||
| CVE-2013-4423 | 1 Redhat | 1 Cloudforms | 2019-11-06 | 2.1 LOW | 5.5 MEDIUM |
| CloudForms stores user passwords in recoverable format | |||||
| CVE-2018-19158 | 1 Colossusxt | 1 Colossuscoinxt | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2019-18657 | 1 Yandex | 1 Clickhouse | 2019-11-06 | 5.0 MEDIUM | 5.3 MEDIUM |
| ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. | |||||
| CVE-2018-19152 | 1 Emercoin | 1 Emercoin | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| emercoin through 0.7 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM. | |||||
| CVE-2018-19153 | 1 Particl | 1 Particl | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| particl through 0.17 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM. | |||||
| CVE-2018-19154 | 1 Htmlcoin | 1 Htmlcoin | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| HTMLCOIN through 2.12 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM. | |||||
| CVE-2018-19155 | 1 Navcoin | 1 Navcoin | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| navcoin through 4.3.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM. | |||||
| CVE-2018-19156 | 1 Pivx | 1 Pivx | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| PIVX through 3.1.03 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2018-19157 | 1 Phore | 1 Phore | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| Phore through 1.3.3.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2018-19159 | 1 Luxcore | 1 Lux | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| lux through 5.2.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2018-19160 | 1 Bit.diamonds | 1 Diamond | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| Diamond through 3.0.1.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2018-19167 | 1 Cloakcoin | 1 Cloakcoin | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| CloakCoin through 2.2.2.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2018-4064 | 1 Sierrawireless | 2 Airlink Es450, Airlink Es450 Firmware | 2019-11-06 | 5.5 MEDIUM | 7.1 HIGH |
| An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the device. An attacker can make an authenticated HTTP request to trigger this vulnerability. | |||||
| CVE-2014-3649 | 1 Redhat | 1 Jboss Aerogear | 2019-11-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| JBoss AeroGear has reflected XSS via the password field | |||||
| CVE-2019-17266 | 2 Canonical, Gnome | 2 Ubuntu Linux, Libsoup | 2019-11-06 | 7.5 HIGH | 9.8 CRITICAL |
| libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy. | |||||
| CVE-2019-18464 | 1 Ipswitch | 1 Moveit Transfer | 2019-11-06 | 7.5 HIGH | 9.8 CRITICAL |
| In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database. | |||||
| CVE-2019-15710 | 1 Fortiguard | 2 Fortiextender, Fortiextender Firmware | 2019-11-06 | 9.0 HIGH | 7.2 HIGH |
| An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands. | |||||
| CVE-2007-5536 | 2 Hp, Openssl | 2 Hp-ux, Openssl | 2019-11-06 | 4.9 MEDIUM | N/A |
| Unspecified vulnerability in OpenSSL before A.00.09.07l on HP-UX B.11.11, B.11.23, and B.11.31 allows local users to cause a denial of service via unspecified vectors. | |||||
| CVE-2013-4751 | 3 Fedoraproject, Redhat, Sensiolabs | 3 Fedora, Enterprise Linux, Symfony | 2019-11-06 | 4.9 MEDIUM | 8.1 HIGH |
| php-symfony2-Validator has loss of information during serialization | |||||
| CVE-2018-1000879 | 3 Fedoraproject, Libarchive, Opensuse | 3 Fedora, Libarchive, Leap | 2019-11-06 | 4.3 MEDIUM | 6.5 MEDIUM |
| libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file. | |||||
| CVE-2012-6124 | 1 Call-cc | 1 Chicken | 2019-11-06 | 5.0 MEDIUM | 5.3 MEDIUM |
| A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)." | |||||
| CVE-2018-20320 | 2019-11-06 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11032. Reason: This candidate is a reservation duplicate of CVE-2019-11032. Notes: All CVE users should reference CVE-2019-11032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. | |||||
| CVE-2013-4518 | 1 Redhat | 2 Enterprise Linux, Update Infrastructure | 2019-11-06 | 2.1 LOW | 5.5 MEDIUM |
| RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates | |||||
| CVE-2013-2260 | 1 Cryptocat Project | 1 Cryptocat | 2019-11-06 | 5.0 MEDIUM | 9.8 CRITICAL |
| Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness | |||||
| CVE-2019-18653 | 2 Avast, Microsoft | 2 Antivirus, Windows | 2019-11-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. | |||||
| CVE-2018-19162 | 1 Diviproject | 1 Divi | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| Divi through 4.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2013-0178 | 1 Redislabs | 1 Redis | 2019-11-06 | 3.6 LOW | 5.5 MEDIUM |
| Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm. | |||||
| CVE-2018-19163 | 1 Stratisplatform | 1 Stratisx | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| stratisX through 2.0.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2018-19164 | 1 Reddcoin | 1 Reddcoin | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| reddcoin through 2.1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2013-0180 | 1 Redislabs | 1 Redis | 2019-11-06 | 3.6 LOW | 5.5 MEDIUM |
| Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds. | |||||
| CVE-2013-2258 | 1 Cryptocat Project | 1 Cryptocat | 2019-11-06 | 5.0 MEDIUM | 5.3 MEDIUM |
| Cryptocat before 2.0.22 has Nickname User Impersonation | |||||
| CVE-2018-19165 | 1 Nebl | 1 Neblio | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| neblio through 1.5.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2013-4104 | 1 Cryptocat Project | 1 Cryptocat | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol | |||||
| CVE-2015-8980 | 4 Fedoraproject, Opensuse, Php-gettext Project and 1 more | 4 Fedora, Leap, Php-gettext and 1 more | 2019-11-06 | 7.5 HIGH | 9.8 CRITICAL |
| The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. | |||||
| CVE-2018-19166 | 1 Peercoin | 1 Peercoin | 2019-11-06 | 5.0 MEDIUM | 7.5 HIGH |
| peercoin through 0.6.4 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. | |||||
| CVE-2013-2075 | 1 Call-cc | 1 Chicken | 2019-11-06 | 7.5 HIGH | 8.8 HIGH |
| Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for CVE-2012-6122. | |||||
| CVE-2018-3983 | 1 Atlantiswordprocessor | 1 Atlantis Word Processor | 2019-11-06 | 6.8 MEDIUM | 7.8 HIGH |
| An exploitable uninitialized pointer vulnerability exists in the Word document parser of the the Atlantis Word Processor. A specially crafted document can cause an array fetch to return an uninitialized pointer and then performs some arithmetic before writing a value to the result. Usage of this uninitialized pointer can allow an attacker to corrupt heap memory resulting in code execution under the context of the application. An attacker must convince a victim to open a document in order to trigger this vulnerability. | |||||