CVEs published in July 2019
1,618 vulnerabilities, 265 critical, 12 exploited.
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x...6.1 Medium
- phpmain/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by...7.5 High
- damicmsAn arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators...4.9 Medium
- paypal adaptive payments sdkpaypal/adaptivepayments-sdk-php vulnerable to a reflected XSS6.1 Medium
- libpng, netapp active iq unified manager +1 morelibpng before 1.6.32 does not properly check the length of chunks against the user limit.9.8 Critical
- hsycmsAn issue was discovered in Hsycms V1.1. There is a SQL injection vulnerability via a /news/*.html...9.8 Critical
- nagios xiNagios XI before 5.5.4 has XSS in the auto login admin management page.4.8 Medium
- teclib-edition newsAn issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS...6.1 Medium
- oniguruma project oniguruma, fedoraproject fedora +1 moreA NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to...6.5 Medium
- glpi-project glpiAn issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is...5.9 Medium
- cyberpowersystems powerpanelCSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an...8.8 High
- getflightpath flightpathFlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the...5.3 Medium
- helpy.io helpyHelpy before 2.2.0 allows agents to edit admins.8.8 High
- vivotek fd8136 firmwareVivotek FD8136 devices allow remote memory corruption and remote code execution because of a...9.8 Critical
- vivotek fd8136 firmwareVivotek FD8136 devices allow Remote Command Injection, aka "another command injection...9.8 Critical
- vivotek fd8136 firmwareVivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget.9.8 Critical
- teclib-edition fieldsAn issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL...9.8 Critical
- nic knot resolver, cz.nic knot-resolver, fedoraproject fedora +2 moreA vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows...6.3 Medium
- nic knot resolver, cz.nic knot-resolver, fedoraproject fedora +2 moreA vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0...5.4 Medium
- eq-3 ccu2 firmware, ccu3 firmware +1 moreeQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows...9.8 Critical
- eq-3 ccu2 firmware, ccu3 firmware +1 moreeQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for...9.8 Critical
- eq-3 ccu2 firmware, ccu3 firmware +1 moreeQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for...9.8 Critical
- clusterlabs fence-agents, redhat enterprise linux, enterprise linux server +1 more +3 moreA flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters...5.0 Medium
- eq-3 ccu2 firmware, ccu3 firmware +1 moreOn eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login...8.8 High
- eventum project eventumAn issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another...8.8 High
- eventum project eventumAn issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the...6.1 Medium
- eventum project eventumAn issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter.6.1 Medium
- eventum project eventumAn issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter.6.1 Medium
- eventum project eventumAn issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter.6.1 Medium
- eventum project eventumAn issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the field_name...6.1 Medium
- oniguruma project oniguruma, php, canonical ubuntu linux +2 more +4 moreA use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to...9.8 Critical
- redis, canonical ubuntu linux, debian linux +7 more +9 moreA heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3...7.2 High
- libpng, netapp active iq unified manager, oncommand api services +2 more +4 moreOut-of-bounds write in libpng8.8 High
- yoast seoThe Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in...9.9 Critical
- mobatek mobaxtermIn MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows...8.8 High
- phpwindPHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.6.1 Medium
- matrixsslMatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.9.8 Critical
- mailvelopeMailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web...5.3 Medium
- mailvelopeMailvelope prior to 3.3.0 allows private key operations without user interaction via its client...6.5 Medium
- mailvelopeMailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows...4.3 Medium
- keynto team password managerKEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in...6.1 Medium
- contaoContao SQL injection in the file manager9.8 Critical
- trendnet tew-827dru firmwareTRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker...7.5 High
- mailvelopeMailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As...4.3 Medium
- weseek growiIn WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL...7.5 High
- weseek growiIn WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a...7.5 High
- trendnet tew-827dru firmwareTRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer...8.8 High
- hewlett packard enterprise hpe 3par service processors, hp 3par service processor firmware +1 moreHPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4....9.8 Critical
- modsecurity owasp modsecurity core rule setAn issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead...7.5 High
- cyberpowersystems powerpanelA stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business...5.4 Medium
- Show moreLoading…