CVEs published in October 2019
1,571 vulnerabilities, 242 critical, 7 exploited.
- ibm filenet content managerIBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service...4.1 Medium
- idreamsoft icmsAn issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL...9.8 Critical
- metinfoAn issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c...9.8 Critical
- parity libsecp256k1libsecp256k1 contains side-channel timing attack7.5 High
- zzzcms zzzphpparserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute...9.8 Critical
- centreonCentreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of...8.8 High
- ffmpeg, canonical ubuntu linux, debian linux +2 moreIn FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and...9.8 Critical
- imagemagick, debian linux +1 moreImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.8.8 High
- ffmpeg, canonical ubuntu linux, debian linux +2 moreFFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array...9.8 Critical
- lz4 project lz4, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreLZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to...8.1 High
- gnu aspell, canonical ubuntu linux +1 morelibaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape...9.1 Critical
- osgeo gdal, debian linux, fedoraproject fedora +3 more +5 moreGDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the...9.8 Critical
- imagemagickIn ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.8.8 High
- libtiff, osgeo gdal +1 moretif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has...8.8 High
- imagemagickImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c...8.8 High
libdatetime-timezone-perlDebianlibdatetime-timezone-perl - new upstream versionNo scoretzdataDebiantzdata - new upstream versionNo scoreclamavDebianclamav - regression updateNo scorelibsdl1.2Debianlibsdl1.2 - regression updateNo score- python-ecdsa project python-ecdsa, redhat ceph storage, openstack +1 more +3 moreImproper Verification of Cryptographic Signature in Pure-Python ECDSA7.4 High
- sudo project sudo, canonical ubuntu linux, debian linux +12 more +14 moreIn Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain...8.8 High
- jnoj jiangnan online judgeJiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web...7.5 High
- jnoj jiangnan online judgeJiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web...7.5 High
- gilacms gila cmsGila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the...9.9 Critical
- gilacms gila cmsGila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via...9.3 Critical
- matio project matio, debian linux +1 moreMat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap...8.2 High
- libvipsvips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a...8.8 High
opensslDebianopenssl - regression updateNo score- belkin wemo switch 28b firmwareAn issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS devices. They allow...7.5 High
- fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +19 more +21 morejackson-databind polymorphic typing issue9.8 Critical
- hydra project hydraHydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests...7.5 High
- axiosys bento4An issue was discovered in Bento4 1.5.1.0. There is a SEGV in the function AP4_TfhdAtom:...7.5 High
- axiosys bento4An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in...7.8 High
- axiosys bento4An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in...7.8 High
- landing-cms project landing-cmsAn issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the...6.5 Medium
- hotarucmsA stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page...4.8 Medium
- google chromeInsufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120...6.5 Medium
- google chromeUse after free in JavaScript in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to...8.8 High
- google chromeUse after free in audio in Google Chrome on Android prior to 77.0.3865.120 allowed a remote...8.8 High
- google chromeUse after free in WebRTC in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to...8.8 High
- google chromeUse after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who...8.8 High
- pythonlibrary/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading...7.5 High
- graphite project graphitegraphite.composer.views.send_email vulnerable to SSRF7.5 High
- genesys eservices chatGenesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet...6.1 Medium
- dlink dir-817lw a1 firmware, dir-868l b1 firmware +1 moreThere are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and...9.8 Critical
- boaBoa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls...7.5 High
- dlink dir-816 a1 firmwareAn issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management...7.5 High
- dlink dir-850l a firmware, dir-859 a3 firmware +1 moreOn D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command...9.8 Critical
- dlink dir-846 firmwareD-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS...9.8 Critical
- dlink dir-846 firmwareD-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS...9.8 Critical
- Show moreLoading…