CVEs published in March 2019
1,217 vulnerabilities, 182 critical, 13 exploited.
- podcastgenerator podcast generatorPodcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.6.1 Medium
- samsung syncthru web service, x7400gx firmware +1 moreXSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws...6.1 Medium
- advanced comment system project comment systeminternal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in...6.1 Medium
- samsung syncthru web service, x7400gx firmware +1 moreXSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws...6.1 Medium
- kill-port project kill-portCommand Injection in kill-port8.1 High
- ericsson active library explorerXSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi...6.1 Medium
- opentext documentum webtopXSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter...6.1 Medium
- morgan project morganCode Injection in morgan9.8 Critical
- solarwinds serv-u ftp serverSolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web...4.8 Medium
- localhost-now project localhost-nowPath Traversal in localhost-now7.5 High
- school attendance monitoring system project attendance monitoring systemAttendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php...9.8 Critical
- zyxel dsl-491hnu-b10b firmware, dsl-491hnu-b1b v2 firmware +1 moreZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.8.8 High
- pytorch servePath Traversal in serve7.5 High
- pytorch serveDirectory Traversal in serve7.5 High
- kaiostech kaios, nokia 8810 4g firmware +1 moreA Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform...6.5 Medium
- microweberMicroweber XSS Vulnerability6.1 Medium
- saltosSaltOS 3.1 r8126 contains a database download vulnerability.6.5 Medium
- puppet discoveryPreviously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx...9.8 Critical
- puppet chlorideImproper Certificate Validation in chloride7.5 High
- raisecom iscom ht803g-1ge firmware, iscom ht803g-u firmware, iscom ht803g-w firmware +1 more +3 moreAn authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U,...7.8 High
- qemu, opensuse leap +1 morehw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares...3.3 Low
- kioware serverKioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder...7.8 High
- kentix multisensor-lan firmwareKentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate...9.8 Critical
- raisecom iscom ht803g-1ge firmware, iscom ht803g-u firmware, iscom ht803g-w firmware +1 more +3 moreAn authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U,...7.8 High
- systrome cumilon isg-600c firmware, cumilon isg-600h firmware, cumilon isg-800w firmware +2 moreAn issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with...7.8 High
- layerbbLayerBB 1.1.1 allows XSS via the titles of conversations (PMs).6.1 Medium
- open-xchange appsuiteOX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)5.4 Medium
- hms-networks netbiter ec150 firmware, netbiter ec250 firmware, netbiter lc310 firmware +5 more +7 moreHMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the...6.1 Medium
- layerbbLayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via...6.5 Medium
- open-xchange appsuiteOX App Suite 7.8.4 and earlier allows SSRF.5.4 Medium
- systrome cumilon isg-600c firmware, cumilon isg-600h firmware, cumilon isg-800w firmware +2 moreAn issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin...6.1 Medium
- vertrigoserv project vertrigoservVertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter.6.1 Medium
- skyworthdigital dt721-cb firmware, dt740 firmware, dt741-cb firmware +2 moreAn issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV)...9.8 Critical
- shellinabox project shellinaboxlibhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing...7.5 High
- ens webgalambIn Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the...9.8 Critical
- bose soundtouchAn issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input...6.1 Medium
- avast free antivirusAvast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which...7.8 High
- genivia gsoapSricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests...7.5 High
- airties air 5341 firmwareAirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.8.8 High
- logonbox nervepoint access managerAn unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint...9.4 Critical
- blogengine blogengine.netAn issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File...9.8 Critical
- mastercard qkr\! with masterpassThe MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this...5.9 Medium
- sqlitemanagerSQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter....9.8 Critical
- audiocodes 420hd ip phone firmwareAudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.8.8 High
- audiocodes 420hd ip phone firmwareAudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS.4.8 Medium
- qemu, fedoraproject fedora +1 moreIn QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and...5.5 Medium
- pcre** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow...5.5 Medium
- rockoaRockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain...8.8 High
- invoiceplaneInvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter,...5.4 Medium
- ivanti connect secure, pulsesecure pulse policy secure +1 moreAn XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2...6.1 Medium
- Show moreLoading…