CVEs published in August 2019
2,040 vulnerabilities, 318 critical, 7 exploited.
- altavoz prontuscmscgi-cpn/xcoding/prontus_videocut.cgi in AltaVoz Prontus (aka ProntusCMS) through 12.0.3.0 has ...9.8 Critical
- discourseDiscourse 2.3.2 sends the CSRF token in the query string.6.5 Medium
- xayr xenfcoresharpXENFCoreSharp before 2019-07-16 allows SQL injection in web/verify.php.9.8 Critical
- trms tightrope media carouselThe fetch API in Tightrope Media Carousel before 7.1.3 has CarouselAPI/v0/fetch?url= SSRF. This...10.0 Critical
- webminrpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object...8.8 High
- webminxmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin...6.5 Medium
- insyde h2oelv, h2offt, h2ooae +3 more +5 moreImproper access control in the Insyde software tools may allow an authenticated user to...7.8 High
- eslint-utils project eslint-utilsArbitrary Code Execution in eslint-utils9.8 Critical
- connect-pg-simple project connect-pg-simpleSQL Injection in connect-pg-simple7.3 High
- limesurveyLimesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.7.5 High
- wellness project wellnessFredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php,...9.8 Critical
- xm-online xm\^online 2 user account and authentication serverXM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key.9.8 Critical
- xm-online xm\^online 2 - common utils and endpointsXM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java,...9.8 Critical
- tableau desktop, public desktop, reader +1 more +3 moreNumerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data...7.1 High
- hawn project hawnDianoxDragon Hawn before 2019-07-10 allows SQL injection.9.8 Critical
- reviews module project moduleThe Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.9.8 Critical
- ohdsi webapiOHDSI WebAPI vulnerable to SQL Injection9.8 Critical
- compassionuk compassion switzerlandThe Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models...9.8 Critical
- webimpacto icommktconnectorThe ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.9.8 Critical
- ibm security access manager for enterprise single sign-onIBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External...8.2 High
- ibm db2 high performance unload load for luw, db2 high performance unload load +1 moreIBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and...8.4 High
- ibm db2 high performance unload load for luw, db2 high performance unload load +1 moreIBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and...8.4 High
- ibm open power, p9 openpower +1 moreIBM Open Power Firmware OP910 and OP920 could allow access to BMC via IPMI using default OpenBMC...8.1 High
- alfrescoThe Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider...9.8 Critical
- openforis arenaOpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.9.8 Critical
- idseq idseq-webidseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection...9.8 Critical
- gov ccd-data-store-apiHM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to...9.8 Critical
- beditaBEdita vulnerable to SQL injection9.8 Critical
- clonos project clonosThe WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.9.8 Critical
- cipsoft gesior-aacGesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php.9.8 Critical
- cipsoft gesior-aacGesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.9.8 Critical
- cipsoft gesior-aacGesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.9.8 Critical
- ricoh sp c250dn firmware, sp c250sf firmware, sp c252dn firmware +1 more +3 moreSeveral Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an...9.8 Critical
- ricoh sp c250dn firmware, sp c250sf firmware, sp c252dn firmware +1 more +3 moreSeveral Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for Wi-Fi,...8.8 High
- ricoh sp c250dn firmware, sp c250sf firmware, sp c252dn firmware +1 more +3 moreSeveral Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for SNMP,...8.8 High
- status board project boardStatus Board vulnerable to Cross-Site Scripting before v1.1.826.1 Medium
- lsoft listservReflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts...6.1 Medium
- ricoh sp c250dn firmware, sp c250sf firmware, sp c252dn firmware +1 more +3 moreSeveral Ricoh printers have multiple buffer overflows parsing LPD packets, which allow an...9.8 Critical
- cszcms csz cmsCSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager...9.8 Critical
- progradegrill wifi grilling thermometer firmwareLierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin...9.1 Critical
- flashlingo project flashlingoFlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.9.8 Critical
- gormGORM before 1.9.10 allows SQL injection via incomplete parentheses.9.8 Critical
- social network project networkPvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers...9.8 Critical
- fork-cms fork cms, spoon-library spoon library +1 moreSpoon Library as used in Fork CMS allows PHP object injection9.8 Critical
- laracomlaracom Cross-site Scripting6.1 Medium
- rustls project rustlsrustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to...7.5 High
- raml-module-builder project raml-module-builderRaml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update.9.8 Critical
- gchq cyberchefCross-Site Scripting in cyberchef6.1 Medium
- status board project boardCross-Site Scripting in status-board6.1 Medium
- kaseya virtual system administratorAn issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a...7.5 High
- Show moreLoading…