CVEs published in January 2019
1,173 vulnerabilities, 147 critical, 5 exploited.
- sap se business objects mobile for android, sap businessobjects mobile +1 moreSAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide...7.5 High
- sap hybris, sap se commerce (ex. sap hybris commerce) +1 moreSAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently...6.1 Medium
- sap financial consolidation cube designer, financial consolidation cube designer bobj eades, sap se financial consolidation cube designer (bobj eades) +2 moreA security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8...7.5 High
- sap ea-finserv, s4core, sapscore +5 more +7 moreSAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03;...8.8 High
- ibm spectrum scaleIBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local...4.0 Medium
- ibm api connectIBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access...4.9 Medium
- ibm jazz reporting serviceIBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site...5.4 Medium
- frontaccountingincludes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability...9.8 Critical
- arc project arcARC 5.21q allows directory traversal via a full pathname in an archive file.5.3 Medium
- wplaunchpad wpbackupplus, opensuse leap +1 moreThe WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers...7.5 High
- earclink espcms-p8EARCLINK ESPCMS-P8 has SQL injection in the install_pack/index.php?ac=Member&at=verifyAccount...7.5 High
- apache thriftApache Thrift Node.js static web server sandbox escape6.5 Medium
- linux kernel, netapp active iq performance analytics services, element software management node +2 moreThe mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local...5.5 Medium
- apache thrift, debian linux, f5 traffix signaling delivery controller +2 more +4 moreImproper Input Validation in Apache Thrift7.5 High
- apache karafXML External Entity Reference in Apache Karaf9.8 Critical
- netapp oncommand unified manager for 7-mode (core package), oncommand unified manager +1 moreOnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the...7.4 High
- dokan open source file system, dokan-dev dokany +1 moreDokan file system driver contains a stack-based buffer overflow7.8 High
- djangoproject django, canonical ubuntu linux, debian linux +1 more +3 moreImproper Input Validation in Django6.5 Medium
unitsMageiaUpdated units package fixes security vulnerabilityNo scoreimagemagickMageiaUpdated imagemagick packages fix security vulnerabilities & bugsNo score- gnu binutilsThe demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2...5.5 Medium
- wxjava project wxjavaXML External Entity Reference in weixin-java-tools9.8 Critical
- gnu binutilsload_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer...5.5 Medium
- yunucmsAn issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability...6.1 Medium
- ibm engineering lifecycle optimization - publishing, rational publishing engine +1 moreIBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This...5.4 Medium
- ibm i access for windows, i access +1 moreAn untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on...5.3 Medium
- ibm api connectIBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with...4.3 Medium
- ibm engineering lifecycle optimization - publishing, rational publishing engine +1 moreIBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This...5.4 Medium
- yunucmsYUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to...6.1 Medium
- vtiger crmVtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo...7.2 High
- foxitsoftware foxit reader, phantompdf +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of...7.1 High
- foxitsoftware foxit reader, phantompdf +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is a NULL...5.5 Medium
- foxitsoftware foxit reader, phantompdf +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. They allowed Denial...5.5 Medium
- technicolor tg789vac firmwareThe admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3...6.1 Medium
- webroot brightcloudAn exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the...9.0 Critical
- telegramAn exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of...4.2 Medium
- stripe apiThe Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api...7.5 High
- abb gate-e1 firmware, gate-e2 firmware +1 morePluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an...6.1 Medium
- abb gate-e1 firmware, gate-e2 firmware +1 morePluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow...9.8 Critical
- dell rsa archer, rsa archer grc platform +1 moreDSA-2018-224: RSA Archer GRC Platform Improper Access Control Vulnerability4.3 Medium
- rhymixRhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.9.1 Critical
- rhymixRhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.4.8 Medium
- vivotek cameraCross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x...6.1 Medium
- vivotek cameraCross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware...6.1 Medium
- vivotek cameraIncorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware...5.3 Medium
- sqla yaml fixtures project yaml fixturessqla-yaml-fixtures is vulnerable to Code Injection7.8 High
- cdatatec epon cpe-wifi devices firmwareEPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1...9.8 Critical
- dolibarr erp\/crmDolibarr SQL injection vulnerability in user/card.php8.8 High
- dolibarr erp\/crmDolibarr stored cross-site scripting (XSS) vulnerability5.4 Medium
- dolibarr erp\/crmDolibarr error-based SQL injection vulnerability in product/card.php8.8 High
- Show moreLoading…