CVEs published in October 2019
1,571 vulnerabilities, 242 critical, 7 exploited.
- socomec diris a-40 firmwarePassword disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a...9.8 Critical
- renphoAn issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data...6.8 Medium
- ibm spectrum scaleA security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through...8.1 High
- ibm maximo asset management, control desk, maximo for aviation +7 more +9 moreIBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive...4.3 Medium
- google androidOn certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture...4.6 Medium
- netaddr project netaddrnetaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions9.8 Critical
- mcafee endpoint security, mcafee, llc mcafee endpoint security (ens) +1 moreESConfig Tool access not controlled4.6 Medium
- mcafee endpoint security, mcafee, llc mcafee endpoint security (ens) +1 moreENS code injection in EPSetup.exe5.0 Medium
- isc bind, bind 9 supported preview edition +1 moreBIND Supported Preview Edition can exit with an assertion failure if ECS is in use5.9 Medium
- tibco software inc. mdm, tibco master data management +1 moreTIBCO MDM Exposes Cross-Site Scripting Vulnerabilities6.3 Medium
- gif2png project gif2pnglibpng 1.6.37 has memory leaks in png_malloc_warn and png_create_info_struct.6.5 Medium
- netgear dgn2200 firmware, dgn2200m firmware, dgnd3700 firmware +7 more +9 moreCertain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a...9.8 Critical
- netgear ac1450 firmware, d8500 firmware, dc112a firmware +30 more +32 moreCertain NETGEAR devices allow remote attackers to disable all authentication requirements by...8.1 High
- zyxel nbg-418n v2 firmwarewan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly...9.4 Critical
- dlink dir-615 firmwareAn issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07. wan.htm can...8.2 High
- altair pbs professionalAltair PBS Professional through 19.1.2 allows Privilege Escalation because an attacker can send a...8.0 High
- pi-holePi-Hole 4.3 allows Command Injection.8.8 High
- otcmsOTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into...7.2 High
- otcmsOTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new...6.5 Medium
- s-cmsS-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.6.1 Medium
- exiv2, canonical ubuntu linux, debian linux +2 moreExiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from...6.5 Medium
- zabbixAn issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4....9.1 Critical
- libtom libtomcrypt, debian linux +1 moreIn LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c)...9.1 Critical
- openbsd openssh, netapp cloud backup, steelstore cloud integrated storage +5 more +7 moreOpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a...7.8 High
firefoxUbuntufirefox regressionNo score- solarwinds dameware mini remote controlThe Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication...9.8 Critical
- sap landscape management, sap se landscape management enterprise edition +1 moreUnder certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows...4.9 Medium
- sap dynamic tier, iq, sql anywhere +1 more +3 moreA binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP...5.5 Medium
- sap process integration, sap se process integration, business-to-business add-on +1 moreIn SAP NetWeaver Process Integration (AS2 Adapter), before versions 1.0 and 2.0, the attacker is...5.3 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreSAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before...5.4 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreSAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before...5.4 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreSAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before...5.4 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreSAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before...5.4 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreSAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before...5.4 Medium
- sap financial consolidationDue to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1,...6.5 Medium
- sap financial consolidationSAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user...5.4 Medium
- sap customer relationship management bbpcrm, customer relationship management s4crm, sap se customer relationship management (email management - bbpcrm) +1 more +3 moreSAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0,...5.4 Medium
- sap netweaver process integration, sap se netweaver process integration (b2b toolkit) +1 moreSAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform...4.3 Medium
- knexjs knexSQL Injection in knex9.8 Critical
- nodered node-red-dashboardCross-site Scripting in node-red-dashboard5.4 Medium
- bootstrap-3-typeahead project bootstrap-3-typeahead, red hat bootstrap3-typeahead.js +1 moreCross-site Scripting in Bootstrap-3-Typeahead6.1 Medium
- red hat ansible, redhat ansible engine, debian linux +3 more +5 moreAnsible Uses Plugins That Disclose Credentials7.3 High
- red hat openshiftA vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification. An attacker can take advantage of this f…5.7 Medium
- moxa edr-810 firmwareMoxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to...4.3 Medium
- moxa edr-810 firmwareMoxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping...7.2 High
- fiberhome hg2201t firmware/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre...8.8 High
- opendev octavia, canonical ubuntu linux +1 moreOpenStack Octavia Amphora-Agent not requiring Client-Certificate9.1 Critical
- [unknown] python-ecdsaDuplicate Advisory: possible DoS caused by malformed signature decoding in Pure-Python ECDSA3.7 Low
- centreon webThe token generator in index.php in Centreon Web before 2.8.27 is predictable.5.3 Medium
- fiberhome hg2201t firmware/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows...7.5 High
- Show moreLoading…