CVEs published in October 2019
1,571 vulnerabilities, 242 critical, 7 exploited.
- netgear jnr1010 firmwareNETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice...6.5 Medium
- netgear jnr1010 firmwareNETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS.6.1 Medium
- mindpalette natemailA reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an...6.1 Medium
- 74cmsAn issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method...7.2 High
- qibosoftqibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use...9.8 Critical
- rapidgatorIn the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log...9.8 Critical
- zohocorp manageengine opmanagerAn issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The...9.8 Critical
- seesaw parent and familyIn the Seesaw Parent and Family application 6.2.5 for Android, the username and password are...9.8 Critical
- powerschool mobileIn the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in...9.8 Critical
- minishare project minishareIn MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which...9.8 Critical
- orbitzIn the Orbitz application 19.31.1 for Android, the username and password are stored in the log...9.8 Critical
- darkhorse dark horse comicsIn the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the...9.8 Critical
- infinitestudio infinite designThe Infinite Design application 3.4.12 for Android sends a username and password via TCP without...6.5 Medium
- keycloak rest api, redhat keycloak +1 moreKeycloak Unauthenticated Access5.0 Medium
- haml, debian linux +1 moreHaml vulnerable to cross-site scripting6.1 Medium
- safer-eval project safer-evalSandbox Breakout / Arbitrary Code Execution in safer-eval9.9 Critical
- safer-eval project safer-evalSandbox Breakout / Arbitrary Code Execution in safer-eval9.9 Critical
- doordashIn the DoorDash application through 11.5.2 for Android, the username and password are stored in...9.8 Critical
- gluehome glue smart lock firmwareGlue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the...7.5 High
- intelbras iwr 1000n firmwareIntelbras IWR 1000N 1.6.4 devices allows disclosure of the administrator login name and password...9.8 Critical
- apache hadoop, connect2id nimbus jose\+jwt, oracle communications cloud native core security edge protection proxy +12 more +14 moreImproper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT9.8 Critical
- dolibarr erp\/crmDolibarr ERP and CRM HTML Injection6.1 Medium
- invisible-island ncurses, opensuse leap, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreThere is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the...5.3 Medium
- invisible-island ncurses, opensuse leap, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreThere is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the...5.4 Medium
- jizhicmsJIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.8.8 High
- csv-parse project csv-parse, fedoraproject fedora +1 moreRegular Expression Denial of Service in csv-parse7.5 High
- dogtag jss, jss cryptomanager project cryptomanager, redhat enterprise linux +6 more +8 moreA flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager...6.8 Medium
- ubisoft uplayUbisoft Uplay 92.0.0.6280 has Insecure Permissions.7.8 High
- dell imageassistDell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. Dell...7.5 High
- dlink dir-868l firmware, dir-880l firmware, dir-885l firmware +3 more +5 moreCertain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR...9.8 Critical
- nchsoftware express invoiceIn NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items...5.4 Medium
- autopi 4g\/lte firmware, wi-fi\/nb firmware +1 moreAutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force...9.8 Critical
- bmc patrol agentAn issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the...7.8 High
- bmc patrol agentAn issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the...7.8 High
- open-xchange appsuiteOX App Suite 7.10.1 and 7.10.2 allows SSRF.5.4 Medium
- open-xchange appsuiteOX App Suite through 7.10.2 has Insecure Permissions.8.1 High
- open-xchange appsuiteOX App Suite 7.10.1 and 7.10.2 allows XSS.6.1 Medium
- nazgul nostromo nhttpd, nostromo nhttpd +1 moreDirectory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an...9.8 Critical
- nazgul nostromo nhttpdDirectory Traversal in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an...7.5 High
- idreamsoft icmsidreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption...7.5 High
- eset cyber security, endpoint antivirus, endpoint security +2 moreESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands...7.8 High
- dormsystem project dormsystemtonyy dormsystem through 1.3 allows SQL Injection in admin.php.9.8 Critical
- dlink dir-412 firmwareThere are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW...7.5 High
- sonarsource sonarqubeSonarSource SonarQube before 7.8 has XSS in project links on account/projects.6.1 Medium
- red hat ansible, redhat ansible engine, ansible tower +2 moreAnsible leaks sensitive information to logs when told not to7.3 High
- red hat wildfly-core, redhat data grid, jboss enterprise application platform +2 more +4 moreWildfly Authorization Misconfiguration5.2 Medium
- cloudcti hip integrator recognition configuration toolCloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its...7.8 High
- wbce cmsA file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This...7.2 High
- scadabrA cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1...6.1 Medium
- code-atlantic popup makerAn issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated...9.1 Critical
- Show moreLoading…