Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-13075 | 1 Torproject | 1 Tor Browser | 2019-07-08 | 5.0 MEDIUM | 5.3 MEDIUM |
| Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68. | |||||
| CVE-2019-5965 | 1 Joruri | 1 Joruri Mail | 2019-07-08 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open redirect vulnerability in Joruri Mail 2.1.4 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | |||||
| CVE-2019-5960 | 1 Custom4web | 1 Wp Open Graph | 2019-07-08 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. | |||||
| CVE-2019-13055 | 1 Logitech | 4 K360, K360 Firmware, Unifying Receiver and 1 more | 2019-07-08 | 3.3 LOW | 6.5 MEDIUM |
| Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Frequency transmissions, as demonstrated by an attack against a Logitech K360 keyboard. | |||||
| CVE-2019-13239 | 1 Glpi-project | 1 Glpi | 2019-07-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture. | |||||
| CVE-2016-10761 | 1 Logitech | 10 K360, K360 Firmware, K400r and 7 more | 2019-07-08 | 3.3 LOW | 6.5 MEDIUM |
| Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack. | |||||
| CVE-2018-20807 | 1 Pulsesecure | 1 Pulse Connect Secure | 2019-07-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly. | |||||
| CVE-2019-1577 | 1 Paloaltonetworks | 1 Traps | 2019-07-08 | 6.5 MEDIUM | 6.3 MEDIUM |
| Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML. | |||||
| CVE-2019-12448 | 1 Gnome | 1 Gvfs | 2019-07-08 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write. | |||||
| CVE-2019-13339 | 1 1234n | 1 Minicms | 2019-07-07 | 3.5 LOW | 4.8 MEDIUM |
| In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie. | |||||
| CVE-2019-13340 | 1 1234n | 1 Minicms | 2019-07-07 | 3.5 LOW | 4.8 MEDIUM |
| In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186. | |||||
| CVE-2019-13341 | 1 1234n | 1 Minicms | 2019-07-07 | 3.5 LOW | 4.8 MEDIUM |
| In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie. | |||||
| CVE-2017-17972 | 1 Archon Project | 1 Archon | 2019-07-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362. | |||||
| CVE-2019-3873 | 1 Redhat | 3 Enterprise Linux, Jboss Enterprise Application Platform, Single Sign-on | 2019-07-06 | 6.0 MEDIUM | 9.0 CRITICAL |
| It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks. | |||||
| CVE-2017-18346 | 1 Web-gooroo | 1 Cms Web-gooroo | 2019-07-05 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to execute arbitrary SQL commands via the wbg_login parameter. | |||||
| CVE-2019-13028 | 1 Minv | 1 Electronic Identification Cards Client | 2019-07-05 | 6.8 MEDIUM | 8.8 HIGH |
| An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute arbitrary code (.cgi, .pl, or .php) or delete arbitrary files via a crafted HTML page. This is a product from the Ministry of Interior of the Slovak Republic. | |||||
| CVE-2019-12842 | 1 Jetbrains | 1 Teamcity | 2019-07-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2. | |||||
| CVE-2018-12250 | 1 Elitecms | 1 Elite Cms | 2019-07-05 | 6.5 MEDIUM | 7.2 HIGH |
| An issue was discovered in Elite CMS Pro 2.01. In /admin/add_sidebar.php, the ?page= parameter is vulnerable to SQL injection. | |||||
| CVE-2018-14863 | 1 Odoo | 1 Odoo | 2019-07-05 | 5.5 MEDIUM | 8.1 HIGH |
| Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC. | |||||
| CVE-2018-14864 | 1 Odoo | 1 Odoo | 2019-07-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment. | |||||
| CVE-2018-14865 | 1 Odoo | 1 Odoo | 2019-07-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files. | |||||
| CVE-2019-13067 | 1 Nginx | 1 Njs | 2019-07-05 | 7.5 HIGH | 9.8 CRITICAL |
| njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-12207 is in place. | |||||
| CVE-2017-6216 | 1 Novaksolutions | 1 Infusionsoft-php-sdk | 2019-07-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution | |||||
| CVE-2018-11686 | 1 Flowpaper | 1 Flexpaper | 2019-07-05 | 7.5 HIGH | 9.8 CRITICAL |
| The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php. | |||||
| CVE-2018-15520 | 1 Lexmark | 68 Cx421, Cx421 Firmware, Cx522 and 65 more | 2019-07-05 | 7.5 HIGH | 9.8 CRITICAL |
| Various Lexmark devices have a Buffer Overflow (issue 2 of 2). | |||||
| CVE-2019-9846 | 1 Rockoa | 1 Rockoa | 2019-07-05 | 4.0 MEDIUM | 8.8 HIGH |
| RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection. | |||||
| CVE-2018-10986 | 1 Open-xchange | 1 Ox Guard | 2019-07-05 | 6.8 MEDIUM | 8.8 HIGH |
| OX Guard 2.8.0 has CSRF. | |||||
| CVE-2018-17560 | 1 Teamwire | 1 Teamwire | 2019-07-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected. | |||||
| CVE-2018-17170 | 1 Teamwire | 1 Teamwire | 2019-07-05 | 6.8 MEDIUM | 8.1 HIGH |
| Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected. | |||||
| CVE-2018-14887 | 1 Odoo | 1 Odoo | 2019-07-05 | 5.8 MEDIUM | 6.5 MEDIUM |
| Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request. | |||||
| CVE-2018-14885 | 1 Odoo | 1 Odoo | 2019-07-05 | 7.5 HIGH | 9.8 CRITICAL |
| Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds. | |||||
| CVE-2018-14867 | 1 Odoo | 1 Odoo | 2019-07-05 | 5.0 MEDIUM | 5.3 MEDIUM |
| Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters. | |||||
| CVE-2018-15519 | 1 Lexmark | 64 6500, 6500 Firmware, Cx310 and 61 more | 2019-07-05 | 7.5 HIGH | 9.8 CRITICAL |
| Various Lexmark devices have a Buffer Overflow (issue 1 of 2). | |||||
| CVE-2018-11317 | 1 Intelliants | 1 Subrion | 2019-07-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| Subrion CMS before 4.1.4 has XSS. | |||||
| CVE-2019-12760 | 1 Parso Project | 1 Parso | 2019-07-05 | 6.0 MEDIUM | 7.5 HIGH |
| ** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration." | |||||
| CVE-2018-7054 | 3 Canonical, Debian, Irssi | 3 Ubuntu Linux, Debian Linux, Irssi | 2019-07-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits. NOTE: this issue exists because of an incomplete fix for CVE-2017-7191. | |||||
| CVE-2018-20814 | 1 Pulsesecure | 2 Pulse Connect Secure, Pulse Policy Secure | 2019-07-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX. | |||||
| CVE-2019-4102 | 3 Ibm, Linux, Microsoft | 3 Db2, Linux Kernel, Windows | 2019-07-04 | 4.3 MEDIUM | 5.9 MEDIUM |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158092. | |||||
| CVE-2019-4154 | 3 Ibm, Linux, Microsoft | 3 Db2, Linux Kernel, Windows | 2019-07-04 | 7.2 HIGH | 7.8 HIGH |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 158519. | |||||
| CVE-2019-4386 | 1 Ibm | 1 Db2 | 2019-07-04 | 4.0 MEDIUM | 6.5 MEDIUM |
| IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714. | |||||
| CVE-2019-9701 | 1 Symantec | 1 Data Loss Prevention | 2019-07-03 | 3.5 LOW | 4.8 MEDIUM |
| DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. | |||||
| CVE-2018-20809 | 1 Pulsesecure | 2 Pulse Connect Secure, Pulse Policy Secure | 2019-07-03 | 5.0 MEDIUM | 7.5 HIGH |
| A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5. This is not applicable to PCS 8.1RX. | |||||
| CVE-2018-16077 | 1 Google | 1 Chrome | 2019-07-03 | 4.3 MEDIUM | 6.5 MEDIUM |
| Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page. | |||||
| CVE-2018-20810 | 1 Pulsesecure | 2 Pulse Connect Secure, Pulse Policy Secure | 2019-07-03 | 7.5 HIGH | 9.8 CRITICAL |
| Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices. | |||||
| CVE-2018-20811 | 1 Pulsesecure | 1 Pulse Connect Secure | 2019-07-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12. | |||||
| CVE-2019-7263 | 1 Nortekcontrol | 4 Linear Emerge Elite, Linear Emerge Elite Firmware, Linear Emerge Essential and 1 more | 2019-07-03 | 10.0 HIGH | 9.8 CRITICAL |
| Linear eMerge E3-Series devices have a Version Control Failure. | |||||
| CVE-2015-4033 | 1 Samsung | 1 S-beam | 2019-07-03 | 3.3 LOW | N/A |
| Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000. | |||||
| CVE-2015-5065 | 1 Intelligent-it | 1 Paypal Currency Converter Basic For Woocommerce | 2019-07-03 | 5.0 MEDIUM | N/A |
| Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter. | |||||
| CVE-2019-6622 | 1 F5 | 13 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 10 more | 2019-07-03 | 6.5 MEDIUM | 7.2 HIGH |
| On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems. | |||||
| CVE-2019-13082 | 1 Chamilo | 1 Chamilo Lms | 2019-07-03 | 7.5 HIGH | 9.8 CRITICAL |
| Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because one can access this file from the website, it is remote code execution. This is related to a scorm imsmanifest.xml file, the import_package function, and extraction in $courseSysDir.$newDir. | |||||