CVEs published in October 2019
1,571 vulnerabilities, 242 critical, 7 exploited.
- fusionpbxIn FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c"...6.1 Medium
- rocket.chatRocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.6.1 Medium
- fusionpbxIn FusionPBX up to 4.5.7, the file app\sip_status\sip_status.php uses an unsanitized "savemsg"...6.1 Medium
- fusionpbxAn issue was discovered in FusionPBX up to 4.5.7. In the file app\conference_controls...6.1 Medium
- freepbx manager, sangoma freepbx +1 moreAn issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14...6.1 Medium
- freepbx contactmanager, sangoma freepbx +1 moreAn issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x...6.1 Medium
- fusionpbxresources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to...7.2 High
- trend micro anti-threat toolkit (attk), trendmicro anti-threat toolkit +1 moreTrend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that...7.8 High
- fusionpbxapp/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a...8.8 High
- ricoh mp 501 firmwareOn the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered...6.1 Medium
- citrix application delivery controller firmware, gateway firmware, netscaler gateway firmware +2 moreAn issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway before 10.5...9.8 Critical
- gnu libidn2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreidn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via...9.8 Critical
- renovatebot renovateRenovate before 19.38.7 Credential Exposure via Go Modules8.7 High
- fusionpbxIn FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\conferences_active\conference_interactive.php uses an...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable...6.5 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized ...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec"...6.5 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\recordings\recording_play.php uses an unsanitized ...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file resources\paging.php has a paging function (called by several...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\conference_profiles\conference_profile_params.php uses an...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\access_controls\access_control_nodes.php uses an...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file...6.5 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\contacts\contact_urls.php uses an unsanitized "id"...6.1 Medium
- fusionpbxIn FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an...8.8 High
- fusionpbxIn FusionPBX up to v4.5.7, the file app\devices\device_settings.php uses an unsanitized "id"...6.1 Medium
- sonatype nexus repository manager, nexus iq server +1 moreUnrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager7.2 High
- file project file, canonical ubuntu linux, debian linux +3 more +5 morecdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR...7.8 High
- proftpdProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service...7.5 High
- open-emr openemrReflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote...6.1 Medium
- open-emr openemrReflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id...6.1 Medium
- libssh2, debian linux, fedoraproject fedora +10 more +12 moreIn libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer...8.1 High
- verodin directorAn Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and...7.7 High
- verodin directorThere is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips,...5.4 Medium
- asus rog zephyrus m gm501gs firmware** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313...6.8 Medium
- google flatbuffersUnsound casting in flatbuffers9.8 Critical
- video converter project converterThe Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption)...7.7 High
- etherpadtemplates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of...6.1 Medium
- wago pfc firmwareInformation Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to...5.8 Medium
- xmlsoft libxslt, canonical ubuntu linux, debian linux +2 moreNokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability7.5 High
- hcl travelerHCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the...5.4 Medium
- hornerautomation cscapeIn Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been...7.8 High
- hornerautomation cscapeIn Horner Automation Cscape 9.90 and prior, improper validation of data may cause the system to...7.8 High
- openwrtOpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless...8.8 High
- sagemath sagemathcell** DISPUTED ** An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python...9.8 Critical
- tomedo serverThe Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP ...9.8 Critical
- managewp broken link checkerA reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link...5.4 Medium
- doas project doasAn issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A...8.8 High
- doas project doasAn issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On...9.8 Critical
- Show moreLoading…