CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- zenphoto Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows... 6.5 Medium
- zenphoto The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which... 6.1 Medium
- zenphoto Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to... 6.1 Medium
- zenphoto SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute... 7.2 High
- ezxml project ezxml An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles... 6.5 Medium
- ezxml project ezxml An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a... 6.5 Medium
- ezxml project ezxml An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing... 6.5 Medium
- ezxml project ezxml An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML... 6.5 Medium
- ezxml project ezxml An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to... 6.5 Medium
- fibranet monitorix Cross-site scripting (XSS) vulnerability in the handle_request function in lib/HTTPServer.pm in... 6.1 Medium
- fibranet monitorix The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote... 9.8 Critical
- goscript project goscript go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell... 9.8 Critical
- samba, redhat enterprise linux +1 more Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow... 4.7 Medium
- avira free antivirus, antivirus free antivirus +1 more Avira Free Antivirus is proned to a local privilege escalation through the execution of kernel code from a restricted user. 8.1 High
- nagios xi In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell... 8.8 High
- gksu-polkit-0.0.3-6.fc18, gksu-polkit project gksu-polkit, fedoraproject fedora +2 more gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was... 7.8 High
- amazon blink xt2 sync module firmware Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary... 9.8 Critical
- it-novum openitcockpit openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component. 6.1 Medium
- gencat portal d\'acces a la universitat The Java API in Generalitat de Catalunya accesuniversitat.gencat.cat 1.7.5 allows remote... 4.3 Medium
-
clamavMageia Updated clamaw packages fix security issue No score -
filezillaMageia,libfilezillaMageia +1 more Updated filezilla packages fix security vulnerability No score - ricoh fusionpro vdp A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in... 7.5 High
- unity3d unity editor The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute... 8.8 High
- paessler prtg network monitor PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. NOTE: This... 6.1 Medium
- paessler prtg network monitor PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl... 6.1 Medium
- boltcms bolt Bolt Cross-site Scripting via the slug, teaser or title parameters 6.1 Medium
- craftcms craft cms In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field... 6.1 Medium
- fiberhomegroup an5506-04-f firmware FiberHome an5506-04-f RP2669 devices have XSS. 5.4 Medium
- rovinbhandari ftp project ftp An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in... 7.5 High
- metalgenix genixcms GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. 6.1 Medium
- ddq project ddq The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token,... 7.5 High
- cryptbond network project network The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an... 7.5 High
- newinteltechmedia project newinteltechmedia The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable... 7.5 High
- business alliance financial circle project alliance financial circle The UBSexToken() function of a smart contract implementation for Business Alliance Financial... 7.5 High
- bombba project bombba The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum... 7.5 High
- mailstore, mailstore server +1 more An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x... 8.8 High
- sylius grid, sylius +1 more XSS injection in the Grid component of Sylius 4.8 Medium
- outsystems OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications... 6.5 Medium
- zohocorp manageengine adselfservice plus An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed... 9.1 Critical
- pureftpd pure-ftpd, fedoraproject fedora +1 more In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c. 7.5 High
- qemu ** DISPUTED ** An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2... 7.5 High
- serenityos Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with... 7.8 High
- linux kernel, opensuse leap +1 more In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting... 6.0 Medium
- sonicwall sonicos, sonicosv +1 more A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to... 7.2 High
- libvnc libvncserver LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the... 8.8 High
- debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via... 6.5 Medium
- debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Use after free vulnerability in EDK II may allow an authenticated user to potentially enable... 8.0 High
- tianocore edk2 Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable... 7.8 High
- debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to... 7.8 High
- debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of... 7.8 High
- Show olderLoading…