CVEs published in May 2019
1,381 vulnerabilities, 265 critical, 14 exploited.
- ge communicatorGE Communicator, all versions prior to 4.0.517, has a service running with system privileges that...5.6 Medium
- ge communicatorGE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded...9.8 Critical
- ge communicatorGE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files...7.8 High
- ge communicatorGE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place...7.8 High
- document foundation libreofficeExecutable hyperlink targets executed unconditionally on activation7.8 High
- haproxyHAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized,...5.9 Medium
- engeniustech ews660ap firmwareThe EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary...9.8 Critical
- apache karafApache Karaf vulnerable to relative path traversal4.9 Medium
- f5 njsnjs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after...9.8 Critical
- f5 njsnjs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice...9.8 Critical
- f5 njsnjs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for...7.5 High
- rediff rediffmailThe Rediffmail (aka com.rediff.mail.and) application 2.2.6 for Android has cleartext mail content...4.6 Medium
- humhub calendarInformation exposure through process environment vulnerability in Synology Calendar before 2.3.3...5.5 Medium
- davegamble cjson, oracle timesten in-memory database +1 morecJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.9.8 Critical
- davegamble cjson, oracle timesten in-memory database +1 morecJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.9.8 Critical
- typo3TYPO3 Image Processing susceptible to Code Execution7.5 High
- typo3 pharstreamwrapperPharStreamWrapper for Typo3 unsafe deserialization vulnerability9.8 Critical
postgresql-9.4Debianpostgresql-9.4 - new upstream versionNo score- golang crypto, debian linux +1 moregolang.org/x/crypto/salsa20/salsa uses insufficiently random values5.9 Medium
- postgresql, opensuse leap +1 moreA vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding...3.1 Low
- imagemagickIn ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM,...7.5 High
- imagemagickIn ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage...7.5 High
- cyberark enterprise password vaultAn XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk...9.8 Critical
- symantec antivirus engineSymantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue,...5.5 Medium
- kaspersky antivirus engineKaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow...8.8 High
- ulicmsMultiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote...6.1 Medium
- intelliants subrion cmsSubrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.6.1 Medium
- cakephpUnsafe deserialization in SmtpTransport in CakePHP7.5 High
- typo3 pharstreamwrapper, debian linux, drupal +2 more +4 moreDirectory Traversal in typo3/phar-stream-wrapper9.8 Critical
- open source alpine linux, f5 big-ip controller, gliderlabs docker-alpine +1 more +3 moreVersions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the ...9.8 Critical
- ivanti connect secureIn Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS...5.8 Medium
- ivanti connect secure, pulsesecure pulse connect secure +1 moreIn Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7...8.6 High
- wincofireworks fw-1007 firmwareAn exploitable improper access control vulnerability exists in the bluetooth low energy...6.5 Medium
- google androidIn wnm_parse_neighbor_report_elem of wnm_sta.c, there is a possible out-of-bounds read due to...5.5 Medium
- google androidIn VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion. This...7.5 High
- google androidIn heap of spaces.h, there is a possible out of bounds read due to improper input validation....7.5 High
- google androidIn tearDownClientInterface of WificondControl.java, there is a possible use after free due to...7.8 High
- google androidIn SendMediaUpdate and SendFolderUpdate of avrcp_service.cc, there is a possible memory...7.8 High
- google androidIn UpdateLoadElement of ic.cc, there is a possible out-of-bounds write due to type confusion....9.8 Critical
- google androidIn CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to...9.8 Critical
- google androidIn JSCallTyper of typer.cc, there is an out of bounds write due to an incorrect bounds check....9.8 Critical
- google androidIn MakeMP>G4VideoCodecSpecificData of APacketSource.cpp, there is a possible out-of-bounds write...8.8 High
- google androidIn SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege...7.3 High
- ivanti connect secure, pulse connect secure +1 moreIn Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7...9.9 Critical
- citrix netscaler sd-wan, sd-wan +1 moreCitrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper...5.9 Medium
- chuango a11 firmware, a8 firmware, awv plus firmware +7 more +9 moreThe Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack. When...5.9 Medium
- humhubA cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject...6.1 Medium
- alkacon opencmsAlkacon OpenCMS CSV Injection via New User module7.8 High
- alkacon opencmsAlkacon OpenCMS XSS via New User module6.1 Medium
- oneshield policyA log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework...8.8 High
- Show moreLoading…