Original release date: May 20, 2019
The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.
The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
-
High – Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 – 10.0
-
Medium – Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 – 6.9
-
Low – Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 – 3.9
Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.
The NCCIC Weekly Vulnerability Summary Bulletin is created using information from the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
High Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| anker-in — roav_dashcam_a1_firmware | An exploitable code execution vulnerability exists in Wi-Fi Command 9999 of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability. | 2019-05-13 | 7.5 | CVE-2018-4014 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability. | 2019-05-13 | 7.5 | CVE-2018-4016 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9. A set of default credentials can potentially be used to connect to the device. An attacker can connect to the AP to trigger this vulnerability. | 2019-05-13 | 8.3 | CVE-2018-4017 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server allows for arbitrary firmware binaries to be uploaded which will be flashed upon next reboot. An attacker can send an HTTP PUT request or upgrade firmware request to trigger this vulnerability. | 2019-05-13 | 10.0 | CVE-2018-4018 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. | 2019-05-13 | 7.5 | CVE-2018-4023 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable denial-of-service vulnerability exists in the thumbnail display functionality of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a null pointer dereference, resulting in a device reboot. | 2019-05-13 | 7.8 | CVE-2018-4024 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable denial-of-service vulnerability exists in the XML_GetRawEncJpg Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause an invalid memory dereference, resulting in a device reboot. | 2019-05-13 | 7.8 | CVE-2018-4025 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable denial-of-service vulnerability exists in the XML_GetScreen Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted set of packets can cause an invalid memory dereference, resulting in a device reboot. | 2019-05-13 | 7.8 | CVE-2018-4026 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable denial-of-service vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a semaphore deadlock, which prevents the device from receiving any physical or network inputs. An attacker can send a specially crafted packet to trigger this vulnerability. | 2019-05-13 | 7.8 | CVE-2018-4027 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. The HTTP server could allow an attacker to overwrite the root directory of the server, resulting in a denial of service. An attacker can send an HTTP POST request to trigger this vulnerability. | 2019-05-13 | 7.8 | CVE-2018-4028 MISC |
| anker-in — roav_dashcam_a1_firmware | An exploitable code execution vulnerability exists in the HTTP request-parsing function of the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause an unlimited and arbitrary write to memory, resulting in code execution. | 2019-05-13 | 7.5 | CVE-2018-4029 MISC |
| apachefriends — xampp | XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued. | 2019-05-14 | 7.5 | CVE-2019-8923 MISC FULLDISC BID MISC MISC MISC EXPLOIT-DB |
| asus — rt-ac3200_firmware | System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the “load_script” URL parameter. | 2019-05-13 | 10.0 | CVE-2018-14714 MISC |
| cisco — enterprise_network_compute_system | A vulnerability in the logic that handles access control to one of the hardware components in Cisco’s proprietary Secure Boot implementation could allow an authenticated, local attacker to write a modified firmware image to the component. This vulnerability affects multiple Cisco products that support hardware-based Secure Boot functionality. The vulnerability is due to an improper check on the area of code that manages on-premise updates to a Field Programmable Gate Array (FPGA) part of the Secure Boot hardware implementation. An attacker with elevated privileges and access to the underlying operating system that is running on the affected device could exploit this vulnerability by writing a modified firmware image to the FPGA. A successful exploit could either cause the device to become unusable (and require a hardware replacement) or allow tampering with the Secure Boot verification process, which under some circumstances may allow the attacker to install and boot a malicious software image. An attacker will need to fulfill all the following conditions to attempt to exploit this vulnerability: Have privileged administrative access to the device. Be able to access the underlying operating system running on the device; this can be achieved either by using a supported, documented mechanism or by exploiting another vulnerability that would provide an attacker with such access. Develop or have access to a platform-specific exploit. An attacker attempting to exploit this vulnerability across multiple affected platforms would need to research each one of those platforms and then develop a platform-specific exploit. Although the research process could be reused across different platforms, an exploit developed for a given hardware platform is unlikely to work on a different hardware platform. | 2019-05-13 | 7.2 | CVE-2019-1649 BID CISCO CERT-VN |
| cisco — ios_xe | A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has valid administrator access to an affected device could exploit this vulnerability by supplying a crafted input parameter on a form in the Web UI and then submitting that form. A successful exploit could allow the attacker to run arbitrary commands on the device with root privileges, which may lead to complete system compromise. | 2019-05-13 | 9.0 | CVE-2019-1862 BID CISCO CERT-VN |
| cisco — nx-os | A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker’s privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands to elevate the attacker’s privilege level. To exploit this vulnerability, the attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit. | 2019-05-15 | 7.2 | CVE-2019-1727 BID CISCO |
| cisco — nx-os | A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to run arbitrary commands at system boot time with the privileges of root. The vulnerability is due to a lack of proper validation of system files when the persistent configuration information is read from the file system. An attacker could exploit this vulnerability by authenticating to the device and overwriting the persistent configuration storage with malicious executable files. An exploit could allow the attacker to run arbitrary commands at system startup and those commands will run as the root user. The attacker must have valid administrative credentials for the device. | 2019-05-15 | 7.2 | CVE-2019-1728 CISCO |
| cisco — nx-os | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the restricted Guest Shell and execute commands at the privilege level of a network-admin user outside of the Guest Shell. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to the incorrect implementation of a CLI command that allows a Bash command to be incorrectly invoked on the Guest Shell CLI. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Guest Shell prompt. A successful exploit could allow the attacker to issue commands that should be restricted by a Guest Shell account. | 2019-05-15 | 7.2 | CVE-2019-1730 CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid user credentials to exploit this vulnerability. | 2019-05-15 | 7.2 | CVE-2019-1735 BID CISCO |
| cisco — nx-os | A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities. NX-OS versions prior to 8.3(1) are affected. | 2019-05-15 | 7.2 | CVE-2019-1767 CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | 7.2 | CVE-2019-1774 BID CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | 7.2 | CVE-2019-1775 BID CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | 7.2 | CVE-2019-1776 CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | 7.2 | CVE-2019-1778 BID CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying operating system of an affected device with elevated privileges. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. NX-OS versions prior to 8.3(1) are affected. NX-OS versions prior to 8.3(1) are affected. | 2019-05-16 | 7.2 | CVE-2019-1780 CISCO |
| cisco — nx-os | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. | 2019-05-15 | 7.2 | CVE-2019-1811 CISCO |
| cisco — nx-os | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. | 2019-05-15 | 7.2 | CVE-2019-1812 CISCO |
| cisco — nx-os | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. | 2019-05-15 | 7.2 | CVE-2019-1813 CISCO |
| d-link — dir-818lw_firmware | In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $path_inf_wan1.”/web” internal configuration memory without any regex checking. And in the IPTWAN_build_command function of the iptwan.php source code, the data in $path_inf_wan1.”/web” is used with the iptables command without any regex checking. A vulnerable /HNAP1/SetRouterSettings XML message could have shell metacharacters in the RemotePort element such as the `telnetd` string. | 2019-05-13 | 10.0 | CVE-2018-19986 MISC |
| d-link — dir-818lw_firmware | D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the `telnetd` string. | 2019-05-13 | 10.0 | CVE-2018-19987 MISC |
| d-link — dir-822_firmware | In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth internal configuration memory without any regex checking. And in the bwc_tc_spq_start, bwc_tc_wfq_start, and bwc_tc_adb_start functions of the bwcsvcs.php source code, the data in /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth is used with the tc command without any regex checking. A vulnerable /HNAP1/SetQoSSettings XML message could have shell metacharacters in the uplink element such as the `telnetd` string. | 2019-05-13 | 10.0 | CVE-2018-19989 MISC |
| d-link — dir-822_firmware | In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1.”/media/wps/enrollee/pin” and $rphyinf2.”/media/wps/enrollee/pin” and $rphyinf3.”/media/wps/enrollee/pin” internal configuration memory without any regex checking. And in the do_wps function of the wps.php source code, the data in $rphyinf3.”/media/wps/enrollee/pin” is used with the wpatalk command without any regex checking. A vulnerable /HNAP1/SetWiFiVerifyAlpha XML message could have shell metacharacters in the WPSPIN element such as the `telnetd` string. | 2019-05-13 | 10.0 | CVE-2018-19990 MISC |
| d-link — dir-868l_firmware | In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element, such as the ‘`telnetd`’ string. | 2019-05-13 | 7.5 | CVE-2018-19988 MISC |
| denx — u-boot | Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow. | 2019-05-10 | 7.5 | CVE-2019-11059 CONFIRM MISC |
| emerson — ve6046_firmware | Emerson VE6046 09.0.12 devices have hardcoded admin credentials allowing remote connection to the Emerson Smart Switch administrative interface via HTTP or SNMPv3. | 2019-05-14 | 10.0 | CVE-2018-11691 MISC MISC MISC |
| enghouse — contact_center:_service_provider | ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an attacker to upload a malicious XML file and reference it in the URL of the application, forcing the application to load and parse the malicious XML file, aka an XXE issue. | 2019-05-14 | 7.5 | CVE-2018-8940 MISC |
| golang — go | Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain privileges. | 2019-05-13 | 7.5 | CVE-2019-11888 MISC |
| gracemedia_media_player_project — gracemedia_media_player | The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the “cfg” parameter. | 2019-05-13 | 7.5 | CVE-2019-9618 FULLDISC FULLDISC MISC |
| hp — synergy_firmware | A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of the HPE Synergy Custom SPP 2018.11.20190205, could allow local or remote unauthorized elevation of privilege. | 2019-05-10 | 7.5 | CVE-2018-7120 CONFIRM |
| konakart — konakart | KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image. | 2019-05-13 | 7.5 | CVE-2019-11680 CONFIRM |
| lg — n1a1_firmware | LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters. | 2019-05-14 | 7.5 | CVE-2018-14839 MISC |
| lightopenid_project — lightopenid | openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method. | 2019-05-10 | 7.5 | CVE-2019-11066 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka ‘Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0884, CVE-2019-0918. | 2019-05-16 | 7.6 | CVE-2019-0911 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0912 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0913 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0914 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0915 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0916 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0917 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0922 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0924 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0925 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0927 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0933 MISC |
| microsoft — chakracore | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933. | 2019-05-16 | 7.6 | CVE-2019-0937 MISC |
| microsoft — edge | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka ‘Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0911, CVE-2019-0918. | 2019-05-16 | 7.6 | CVE-2019-0884 MISC |
| microsoft — edge | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka ‘Chakra Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937. | 2019-05-16 | 7.6 | CVE-2019-0923 MISC |
| microsoft — internet_explorer | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka ‘Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-0884, CVE-2019-0911. | 2019-05-16 | 7.6 | CVE-2019-0918 MISC |
| microsoft — office | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka ‘Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0946, CVE-2019-0947. | 2019-05-16 | 9.3 | CVE-2019-0945 MISC |
| microsoft — office | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka ‘Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0945, CVE-2019-0947. | 2019-05-16 | 9.3 | CVE-2019-0946 MISC |
| microsoft — office | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka ‘Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0945, CVE-2019-0946. | 2019-05-16 | 9.3 | CVE-2019-0947 MISC |
| microsoft — office | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka ‘Microsoft Word Remote Code Execution Vulnerability’. | 2019-05-16 | 9.3 | CVE-2019-0953 MISC |
| microsoft — windows_10 | An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka ‘Windows Kernel Elevation of Privilege Vulnerability’. | 2019-05-16 | 7.2 | CVE-2019-0881 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka ‘Windows OLE Remote Code Execution Vulnerability’. | 2019-05-16 | 9.3 | CVE-2019-0885 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0889 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0890 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0891 MISC |
| microsoft — windows_10 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka ‘Win32k Elevation of Privilege Vulnerability’. | 2019-05-16 | 7.2 | CVE-2019-0892 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0893 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0894 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0895 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0896 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0897 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0898 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0899 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0901, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0900 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0902. | 2019-05-16 | 9.3 | CVE-2019-0901 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka ‘Jet Database Engine Remote Code Execution Vulnerability’. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901. | 2019-05-16 | 9.3 | CVE-2019-0902 MISC |
| microsoft — windows_10 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka ‘GDI+ Remote Code Execution Vulnerability’. | 2019-05-16 | 9.3 | CVE-2019-0903 MISC |
| microsoft — windows_7 | A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka ‘Remote Desktop Services Remote Code Execution Vulnerability’. | 2019-05-16 | 10.0 | CVE-2019-0708 MISC |
| microsoft — windows_server_2008 | A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka ‘Windows DHCP Server Remote Code Execution Vulnerability’. | 2019-05-16 | 7.5 | CVE-2019-0725 MISC |
| nvidia — gpu_driver | NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes, which may lead to denial of service, escalation of privileges, or information disclosure. | 2019-05-10 | 7.2 | CVE-2019-5675 CONFIRM |
| nvidia — gpu_driver | NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), leading to escalation of privileges through code execution. | 2019-05-10 | 7.2 | CVE-2019-5676 CONFIRM |
| page_flip_book_project — page_flip_book | Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter. | 2019-05-13 | 7.5 | CVE-2012-6652 MISC MISC MISC MISC |
| php-fusion — php-fusion | In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload. | 2019-05-14 | 9.0 | CVE-2019-12099 MISC MISC MISC |
| polycom — group_series | An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets. | 2019-05-13 | 10.0 | CVE-2018-15128 MISC |
| seagate — nas_os | SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter. | 2019-05-13 | 7.5 | CVE-2018-12295 MISC |
| sensiolabs — symfony | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection. | 2019-05-16 | 7.5 | CVE-2019-10910 CONFIRM CONFIRM |
| sensiolabs — symfony | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation. | 2019-05-16 | 7.5 | CVE-2019-10913 CONFIRM CONFIRM |
| sharing-file — easy_file_sharing_web_server | An issue was discovered in Easy File Sharing (EFS) Web Server 7.2. A stack-based buffer overflow vulnerability occurs when a malicious POST request has been made to forum.ghp upon creating a new topic in the forums, which allows remote attackers to execute arbitrary code. | 2019-05-13 | 7.5 | CVE-2018-18912 MISC |
| siemens — logo!8_bm_firmware | A vulnerability has been identified in LOGO!8 BM (All versions). Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 7.5 | CVE-2019-10919 MISC |
| siemens — simatic_pcs_7 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions), SIMATIC WinCC (TIA Portal) V15 (All versions), SIMATIC WinCC Runtime Professional (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 Upd3). An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 9.0 | CVE-2019-10916 MISC |
| siemens — simatic_pcs_7 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions), SIMATIC WinCC (TIA Portal) V15 (All versions), SIMATIC WinCC Runtime Professional (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 Upd3). An authenticatd attacker with network access to the DCOM interface could execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires authentication with a low-privileged user account and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 9.0 | CVE-2019-10918 MISC |
| siemens — simatic_pcs_7 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 and newer (All versions). An attacker with network access to affected installations, which are configured without “Encrypted Communication”, can execute arbitrary code. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected installation. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 7.5 | CVE-2019-10922 MISC |
| suricata-ids — suricata | An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow. | 2019-05-13 | 7.5 | CVE-2019-10053 MISC MISC |
| sylabs — singularity | An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host. | 2019-05-14 | 9.0 | CVE-2019-11328 MLIST BID CONFIRM |
| tubigan — welcome_to_our_resort | The Tubigan “Welcome to our Resort” 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php. | 2019-05-14 | 7.5 | CVE-2018-18800 MISC EXPLOIT-DB |
| whatsapp — whatsapp | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15. | 2019-05-14 | 7.5 | CVE-2019-3568 BID MISC |
| xstream_project — xstream | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON. | 2019-05-15 | 7.5 | CVE-2013-7285 MISC MLIST MLIST MLIST CONFIRM |
Medium Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| abus — secvest_wireless_alarm_system_fuaa50000_firmware | Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way. | 2019-05-14 | 4.8 | CVE-2019-9861 MISC FULLDISC BUGTRAQ MISC |
| apachefriends — xampp | XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued. | 2019-05-16 | 4.3 | CVE-2019-8924 MISC MISC MISC MISC MISC MISC MISC |
| applaudsolutions — applaud_hcm | Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring. | 2019-05-16 | 4.3 | CVE-2019-11033 CONFIRM MISC |
| asus — rt-ac3200_firmware | Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the “hook” URL parameter. | 2019-05-13 | 4.3 | CVE-2018-14710 MISC |
| asus — rt-ac3200_firmware | Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs. | 2019-05-13 | 4.3 | CVE-2018-14711 MISC |
| asus — rt-ac3200_firmware | Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the “hook” URL parameter. | 2019-05-13 | 4.0 | CVE-2018-14712 MISC |
| asus — rt-ac3200_firmware | Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the “hook” URL parameter. | 2019-05-13 | 5.5 | CVE-2018-14713 MISC |
| aware — knomi | The Face authentication component in Aware mobile liveness 2.2.1 sdk 2.2.0 for Knomi allows a Biometrical Liveness authentication bypass via parameter tampering of the /knomi/analyze security_level field. | 2019-05-15 | 5.0 | CVE-2019-9196 MISC MISC MISC |
| bibliosoft — bibliopac | Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/. | 2019-05-13 | 4.3 | CVE-2018-16139 MISC |
| bilboplanet — bilboplanet | An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter. | 2019-05-15 | 4.3 | CVE-2014-9917 EXPLOIT-DB |
| bilboplanet — bilboplanet | An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php. | 2019-05-15 | 4.3 | CVE-2014-9918 EXPLOIT-DB |
| bilboplanet — bilboplanet | An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php. | 2019-05-15 | 4.3 | CVE-2014-9919 EXPLOIT-DB |
| capstone-engine — capstone | Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access) in X86_insn_reg_intel in arch/X86/X86Mapping.c. | 2019-05-15 | 4.3 | CVE-2016-7151 CONFIRM CONFIRM |
| cisco — anyconnect_secure_mobility_client | A vulnerability in the HostScan component of Cisco AnyConnect Secure Mobility Client for Linux could allow an unauthenticated, remote attacker to read sensitive information on an affected system. The vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by crafting HTTP traffic for the affected component to download and process. A successful exploit could allow the attacker to read sensitive information on the affected system. | 2019-05-15 | 5.0 | CVE-2019-1853 BID CISCO |
| cisco — evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information. | 2019-05-15 | 4.0 | CVE-2019-1818 BID CISCO |
| cisco — firepower_management_center | A vulnerability in the detection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access control policies. The vulnerability is due to improper validation of ICMP packets. An attacker could exploit this vulnerability by sending crafted ICMP packets to the affected device. A successful exploit could allow the attacker to bypass configured access control policies. | 2019-05-15 | 5.0 | CVE-2019-1832 BID CISCO |
| cisco — firepower_management_center | A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol parser of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies. The vulnerability is due to improper parsing of specific attributes in a TLS packet header. An attacker could exploit this vulnerability by sending malicious TLS messages to the affected system. A successful exploit could allow the attacker to bypass the configured policies for the system, which could allow traffic to flow through without being inspected. | 2019-05-15 | 5.0 | CVE-2019-1833 BID CISCO |
| cisco — ios_xr | A vulnerability in the Multiprotocol Label Switching (MPLS) Operations, Administration, and Maintenance (OAM) implementation of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to the incorrect handling of certain MPLS OAM packets. An attacker could exploit this vulnerability by sending malicious MPLS OAM packets to an affected device. A successful exploit could allow the attacker to cause the lspv_server process to crash. The crash could lead to system instability and the inability to process or forward traffic though the device, resulting in a DoS condition that require manual intervention to restore normal operating conditions. | 2019-05-15 | 6.1 | CVE-2019-1846 BID CISCO |
| cisco — ios_xr | A vulnerability in the Border Gateway Patrol (BGP) Multiprotocol Label Switching (MPLS)-based Ethernet VPN (EVPN) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs when the affected software processes specific EVPN routing information. An attacker could exploit this vulnerability by injecting malicious traffic patterns into the targeted EVPN network. A successful exploit could result in a crash of the l2vpn_mgr process on Provider Edge (PE) device members of the same EVPN instance (EVI). On each of the affected devices, a crash could lead to system instability and the inability to process or forward traffic through the device, resulting in a DoS condition that would require manual intervention to restore normal operating conditions. | 2019-05-15 | 6.1 | CVE-2019-1849 BID CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability. | 2019-05-15 | 4.6 | CVE-2019-1726 CISCO |
| cisco — nx-os | A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated, local attacker to overwrite any file on the file system including system files. These file overwrites by the attacker are accomplished at the root privilege level. The vulnerability occurs because there is no verification of user-input parameters and or digital-signature verification for image files when using a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device and issuing a command at the CLI. Because an exploit could allow the attacker to overwrite any file on the disk, including system files, a denial of service (DoS) condition could occur. The attacker must have valid administrator credentials for the affected device to exploit this vulnerability. | 2019-05-15 | 6.6 | CVE-2019-1729 CISCO |
| cisco — nx-os | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image. | 2019-05-15 | 4.6 | CVE-2019-1809 CISCO |
| cisco — nx-os | A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command in Cisco Nexus 3000 Series and 9000 Series Switches could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. Note: If the device has not been patched for the vulnerability previously disclosed in the Cisco Security Advisory cisco-sa-20190306-nxos-sig-verif, a successful exploit could allow the attacker to boot a malicious software image. | 2019-05-15 | 4.6 | CVE-2019-1810 CISCO |
| cisco — unified_intelligence_center | A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a user’s browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget validation. An attacker could exploit this vulnerability by forcing a user to load a malicious gadget. A successful exploit could allow the attacker to obtain sensitive information, such as current user credentials, or manipulate data between the user’s browser and Cisco Unified Intelligence Center in the context of the malicious gadget. | 2019-05-15 | 4.0 | CVE-2019-1860 BID CISCO |
| cisco — video_surveillance_manager | A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to an affected component. A successful exploit could allow the attacker to download arbitrary files from the affected device, which could contain sensitive information. | 2019-05-15 | 5.0 | CVE-2019-1717 BID CISCO |
| citrix — sharefile | Citrix ShareFile through 19.1 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required. | 2019-05-13 | 5.0 | CVE-2019-7217 MISC |
| citrix — sharefile | Citrix ShareFile through 19.1 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim?s otp physical token or virtual app (like google authenticator) is able to bypass the first authentication phase (username/password mechanism) and log-in using username/otp combination only (phase 2 of 2FA). | 2019-05-13 | 4.3 | CVE-2019-7218 MISC |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function. | 2019-05-17 | 4.3 | CVE-2019-5928 MISC MISC |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application ‘Memo’. | 2019-05-17 | 4.3 | CVE-2019-5929 MISC MISC |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application ‘Mail’. | 2019-05-17 | 4.3 | CVE-2019-5938 MISC MISC |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application ‘Portal’. | 2019-05-17 | 4.3 | CVE-2019-5939 MISC MISC |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application ‘Scheduler’. | 2019-05-17 | 4.3 | CVE-2019-5940 MISC MISC |
| digitaldruid — hoteldruid | HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php. | 2019-05-17 | 4.3 | CVE-2019-8937 MISC MISC EXPLOIT-DB |
| dotcms — dotcms | /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. | 2019-05-14 | 4.3 | CVE-2019-11846 MISC |
| ellucian — banner_enterprise_identity_services | An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner Enterprise Identity Services 8.3, 8.3.1, 8.3.2, and 8.4, in conjunction with SSO Manager. This vulnerability allows remote attackers to steal a victim’s session (and cause a denial of service) by repeatedly requesting the initial Banner Web Tailor main page with the IDMSESSID cookie set to the victim’s UDCID, which in the case tested is the institutional ID. During a login attempt by a victim, the attacker can leverage the race condition and will be issued the SESSID that was meant for this victim. | 2019-05-14 | 6.8 | CVE-2019-8978 MISC FULLDISC MISC MISC MISC BUGTRAQ |
| eq-3 — ccu3_firmware | Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device’s filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. | 2019-05-13 | 5.0 | CVE-2019-9726 MISC |
| eq-3 — ccu3_firmware | Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. | 2019-05-13 | 5.0 | CVE-2019-9727 MISC |
| evernote — evernote | Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim’s files and achieve remote execution command on the victim’s computer. | 2019-05-13 | 4.3 | CVE-2018-18524 MISC MISC |
| fangfa — fdcms | admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection. | 2019-05-16 | 5.0 | CVE-2018-17048 MISC MISC MISC |
| foxitsoftware — foxit_reader | A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set. | 2019-05-13 | 4.6 | CVE-2019-8342 MISC |
| gitlab — gitlab | An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels. | 2019-05-15 | 5.5 | CVE-2019-10108 MISC MISC MISC |
| gitlab — gitlab | An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present). | 2019-05-15 | 5.0 | CVE-2019-10109 MISC MISC MISC MISC |
| gitlab — gitlab | An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The “move issue” feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credentials. | 2019-05-15 | 4.0 | CVE-2019-10110 MISC MISC MISC |
| gitlab — gitlab | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived. | 2019-05-16 | 5.0 | CVE-2019-10112 MISC MISC MISC |
| gitlab — gitlab | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4/projects/<id>/languages requests may allow Uncontrolled Resource Consumption. | 2019-05-16 | 5.0 | CVE-2019-10113 MISC MISC MISC |
| gitlab — gitlab | An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data. | 2019-05-16 | 5.0 | CVE-2019-10114 MISC MISC MISC |
| gitlab — gitlab | An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information. | 2019-05-16 | 4.0 | CVE-2019-10115 MISC MISC MISC |
| gitlab — gitlab | An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Guests of a project were allowed to see Related Branches created for an issue. | 2019-05-16 | 4.0 | CVE-2019-10116 MISC MISC |
| gitlab — gitlab | An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is triggered after successful authentication within the Oauth/:GeoAuthController for the secondary Geo node. | 2019-05-16 | 5.8 | CVE-2019-10117 MISC MISC MISC |
| gitlab — gitlab | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption. | 2019-05-15 | 5.0 | CVE-2019-10640 MISC MISC MISC |
| gitlab — gitlab | An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure. | 2019-05-10 | 4.0 | CVE-2019-11000 BID CONFIRM MISC |
| gridea — gridea | Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution, as demonstrated by child_process.exec and the “<img src=# onerror=’eval(new Buffer(” substring. | 2019-05-13 | 4.3 | CVE-2019-12047 MISC |
| harman — amx_mvp5150_firmware | HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection. | 2019-05-15 | 6.5 | CVE-2019-11224 MISC MISC |
| harpjs — harp | Information exposure through the directory listing in npm’s harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge. | 2019-05-10 | 5.0 | CVE-2019-5437 MISC |
| harpjs — harp | Path traversal using symlink in npm harp module versions <= 0.29.0. | 2019-05-10 | 5.0 | CVE-2019-5438 MISC |
| heimdal_project — heimdal | In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c. | 2019-05-15 | 5.8 | CVE-2019-12098 CONFIRM CONFIRM MISC MISC |
| ibm — cloud_app_management | IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM X-Force ID: 154283. | 2019-05-10 | 5.0 | CVE-2018-1990 BID XF CONFIRM |
| ipbrick — ipbrick_os | An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn’t check for Anti-CSRF tokens, allowing the submission of multiple forms unwillingly by a victim. | 2019-05-13 | 6.8 | CVE-2018-16136 MISC |
| ipbrick — ipbrick_os | An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections. | 2019-05-13 | 6.5 | CVE-2018-16137 MISC |
| kyocera — taskalfa_4002i_firmware | DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP request. | 2019-05-14 | 5.0 | CVE-2018-16656 MISC |
| lg — gamp-7100_firmware | An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100_${today’s_date}.log for reading a filename such as gapm7100_190101.log. | 2019-05-13 | 5.0 | CVE-2019-7404 MISC |
| libnyoci_project — libnyoci | coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandles certain packets with “Uri-Path: (null)” and consequently allows remote attackers to cause a denial of service (segmentation fault). | 2019-05-15 | 5.0 | CVE-2019-12101 MISC |
| lifesize — icon_300_firmware | A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request. | 2019-05-13 | 6.5 | CVE-2019-3702 MISC MISC |
| linux — linux_kernel | In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343. | 2019-05-17 | 4.9 | CVE-2018-7191 MISC MISC MISC MISC MISC MISC MISC |
| macdown_project — macdown | MacDown 0.7.1 allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note. | 2019-05-16 | 4.6 | CVE-2019-12138 MISC |
| metinfo — metinfo | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state. | 2019-05-10 | 6.8 | CVE-2017-12789 MISC |
| microsoft — .net_framework | GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc parameter. | 2019-05-14 | 4.0 | CVE-2019-11397 MISC MISC |
| microsoft — sharepoint_enterprise_server | A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka ‘Microsoft SharePoint Server Remote Code Execution Vulnerability’. | 2019-05-16 | 6.0 | CVE-2019-0952 MISC |
| microsoft — sharepoint_enterprise_server | An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka ‘Microsoft SharePoint Server Information Disclosure Vulnerability’. | 2019-05-16 | 4.0 | CVE-2019-0956 MISC |
| microsoft — sharepoint_enterprise_server | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka ‘Microsoft SharePoint Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2019-0958. | 2019-05-16 | 6.5 | CVE-2019-0957 MISC |
| microsoft — sharepoint_foundation | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka ‘Microsoft SharePoint Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2019-0957. | 2019-05-16 | 6.5 | CVE-2019-0958 MISC |
| microsoft — windows_10 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka ‘Windows GDI Information Disclosure Vulnerability’. This CVE ID is unique from CVE-2019-0758, CVE-2019-0961. | 2019-05-16 | 4.3 | CVE-2019-0882 MISC |
| microstrategy — web_services | An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. The vulnerability is unauthenticated and leads to access to the asset files with the MicroStrategy user privileges. (This includes the credentials to access the admin dashboard which may lead to RCE.) The path traversal is located in a SOAP request in the web service component. | 2019-05-14 | 5.0 | CVE-2018-6885 CONFIRM |
| miniupnp.free — miniupnpd | The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snprintf return value. | 2019-05-15 | 5.0 | CVE-2019-12107 MISC MISC |
| miniupnp.free — miniupnpd | An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in upnpredirect.c. | 2019-05-15 | 5.0 | CVE-2019-12110 MISC MISC |
| miniupnp.free — miniupnpd | A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c. | 2019-05-15 | 5.0 | CVE-2019-12111 MISC MISC |
| miniupnp_project — miniupnpd | The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability. | 2019-05-15 | 5.0 | CVE-2019-12106 MISC MISC |
| miniupnp_project — miniupnpd | A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port. | 2019-05-15 | 5.0 | CVE-2019-12108 MISC MISC MISC |
| miniupnp_project — miniupnpd | A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port. | 2019-05-15 | 5.0 | CVE-2019-12109 MISC MISC MISC |
| mobatek — mobaxterm | In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH server. This affects Passwordless Authentication that has a Password Protected SSH Private Key. | 2019-05-13 | 5.0 | CVE-2019-7690 MISC |
| mycolorway — simditor | Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element. | 2019-05-13 | 4.3 | CVE-2018-19048 MISC MISC MISC MISC |
| nanosvg_project — nanosvg | nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it’s part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file. | 2019-05-15 | 4.3 | CVE-2019-1010258 MISC MISC MISC |
| nvidia — gpu_driver | NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DeviceIoControl where the software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer, which may lead to denial of service. | 2019-05-10 | 4.9 | CVE-2019-5677 CONFIRM |
| openproject — openproject | A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access. | 2019-05-13 | 6.8 | CVE-2019-11600 MISC FULLDISC MISC BUGTRAQ CONFIRM |
| qdpm — qdpm | qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. | 2019-05-14 | 4.3 | CVE-2019-8390 MISC MISC MISC EXPLOIT-DB |
| qdpm — qdpm | qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. | 2019-05-14 | 4.3 | CVE-2019-8391 MISC MISC MISC EXPLOIT-DB |
| remarkable_project — remarkable | lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section. | 2019-05-13 | 5.0 | CVE-2019-12041 MISC |
| remarkable_project — remarkable | In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL. | 2019-05-13 | 4.3 | CVE-2019-12043 MISC |
| ricoh — sp_4510dn_firmware | An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter. | 2019-05-14 | 4.3 | CVE-2019-11845 MISC |
| ricoh — sp_4520dn_firmware | An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter. | 2019-05-14 | 4.3 | CVE-2019-11844 MISC |
| rust-lang — rust | The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust’s safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected. | 2019-05-13 | 6.8 | CVE-2019-12083 MISC MISC |
| samsung — s10_firmware | ** DISPUTED ** Samsung S9+, S10, and XCover 4 P(9.0) devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent application. For example, the victim becomes stuck in a launcher with their Secure Folder locked. NOTE: the researcher mentions “the Samsung Security Team considered this issue as no/little security impact.” | 2019-05-13 | 4.9 | CVE-2019-12087 MISC |
| sap — businessobjects | Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted. | 2019-05-14 | 6.8 | CVE-2019-0287 BID MISC MISC |
| sap — businessobjects | Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted. | 2019-05-14 | 5.8 | CVE-2019-0289 MISC MISC |
| sap — e-commerce | SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54. | 2019-05-14 | 4.3 | CVE-2019-0298 BID MISC MISC |
| sap — identity_management | Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing. | 2019-05-14 | 6.5 | CVE-2019-0301 MISC MISC |
| sap — sap_solution_manager_system | Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740). | 2019-05-14 | 4.0 | CVE-2019-0293 BID MISC MISC |
| sap — treasury_and_risk_management | SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges. | 2019-05-14 | 6.5 | CVE-2019-0280 MISC MISC |
| seagate — nas_os | Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests. | 2019-05-13 | 5.0 | CVE-2018-12296 MISC |
| seagate — nas_os | Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names. | 2019-05-13 | 4.3 | CVE-2018-12297 MISC |
| seagate — nas_os | Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application’s container via a URL path. | 2019-05-13 | 5.0 | CVE-2018-12298 MISC |
| seagate — nas_os | Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the ‘state’ URL parameter. | 2019-05-13 | 5.8 | CVE-2018-12300 MISC |
| seagate — nas_os | Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or localhost. | 2019-05-13 | 5.0 | CVE-2018-12301 MISC |
| seagate — nas_os | Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting. | 2019-05-13 | 4.3 | CVE-2018-12302 MISC |
| seagate — nas_os | Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Website URL. | 2019-05-13 | 4.3 | CVE-2018-12304 MISC |
| sensiolabs — symfony | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security. | 2019-05-16 | 6.0 | CVE-2019-10911 CONFIRM CONFIRM |
| siemens — logo!8_bm_firmware | A vulnerability has been identified in LOGO!8 BM (All versions). Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 5.0 | CVE-2019-10920 MISC |
| siemens — logo!8_bm_firmware | A vulnerability has been identified in LOGO!8 BM (All versions). Unencrypted storage of passwords in the project could allow an attacker with access to port 10005/tcp to obtain passwords of the device. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known | 2019-05-14 | 5.0 | CVE-2019-10921 MISC |
| siemens — logo!_soft_comfort | A vulnerability has been identified in LOGO! Soft Comfort (All versions). The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a manipulated project. In order to exploit the vulnerability, a valid user must open a manipulated project file. No further privileges are required on the target system. The vulnerability could compromise the confidentiality, integrity and availability of the engineering station. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 6.8 | CVE-2019-10924 BID MISC |
| siemens — simatic_wincc_runtime | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4″ – 22″ (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7″ & 15″ (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The affected device offered SNMP read and write capacities with a publicly know hardcoded community string. The security vulnerability could be exploited by an attacker with network access to the affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 6.4 | CVE-2019-6572 MISC |
| siemens — simatic_wincc_runtime | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4″ – 22″ (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7″ & 15″ (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). An attacker with network access to affected devices could potentially obtain a TLS session key. If the attacker is able to observe TLS traffic between a legitimate user and the device, then the attacker could decrypt the TLS traffic. The security vulnerability could be exploited by an attacker who has network access to the web interface of the device and who is able to observe TLS traffic between legitimate users and the web interface of the affected device. The vulnerability could impact the confidentiality of the communication between the affected device and a legitimate user. At the time of advisory publication no public exploitation of the security vulnerability was known. | 2019-05-14 | 5.0 | CVE-2019-6576 MISC |
| sqlite — sqlite | An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability. | 2019-05-10 | 6.8 | CVE-2019-5018 MISC BID MISC |
| suricata-ids — suricata | A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash. | 2019-05-13 | 5.0 | CVE-2019-10050 MISC MISC |
| suse — manager | SUSE Manager until version 4.0.7 and Uyuni until commit 1b426ad5ed0a7191a6fb46bb83e98ae4b99a5ade created world-readable swap files on systems that don’t have a swap already configured and don’t have btrfs as filesystem | 2019-05-13 | 4.3 | CVE-2019-3684 MISC |
| tencent — wechat | vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash) by replacing an emoji file (under the /sdcard/tencent/MicroMsg directory) with a crafted .wxgf file. The content of the replacement must be derived from the phone’s IMEI. The crash occurs upon receiving a message that contains the replaced emoji. | 2019-05-14 | 4.3 | CVE-2019-11419 MISC MISC EXPLOIT-DB |
| tibco — spotfire_analytics_platform_for_aws | The web server component of TIBCO Software Inc.’s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.’s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0. | 2019-05-14 | 4.3 | CVE-2019-11205 MISC MISC |
| tibco — spotfire_analytics_platform_for_aws | The Spotfire library component of TIBCO Software Inc.’s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software Inc.’s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.2.0, and TIBCO Spotfire Server: versions up to and including 7.11.2; 7.12.0; 7.13.0; 7.14.0; 10.0.0; 10.0.1; 10.1.0; and 10.2.0. | 2019-05-14 | 5.0 | CVE-2019-11206 MISC MISC |
| tibco — spotfire_statistics_services | The web interface component of TIBCO Software Inc.’s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected includes database, JMX, LDAP, Windows service account, and user credentials. Affected releases are TIBCO Software Inc.’s TIBCO Spotfire Statistics Services: versions up to and including 7.11.1; 10.0.0. | 2019-05-14 | 4.0 | CVE-2019-11204 BID MISC MISC |
| tp-link — archer_cr700_firmware | TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password. | 2019-05-15 | 4.3 | CVE-2016-10719 MISC |
| typora — typora | Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note. | 2019-05-16 | 4.6 | CVE-2019-12137 MISC |
| vegadesign — profiledesign_cms | Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page, (2) gbs, (3) side, (4) id, (5) imgid, (6) cat, or (7) orderby parameter. | 2019-05-13 | 4.3 | CVE-2019-7409 MISC MISC |
| virginmedia — hub_3.0_firmware | On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep the connection open, the router lags and becomes unusable to anyone currently using the web interface. | 2019-05-13 | 5.0 | CVE-2018-19037 MISC |
| whatsapp — whatsapp | A bug in WhatsApp for Android’s messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user’s account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 – 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38. | 2019-05-10 | 4.3 | CVE-2019-3566 MISC |
| wso2 — api_manager | An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper. | 2019-05-14 | 4.0 | CVE-2019-6512 MISC MISC |
| wso2 — api_manager | An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user. | 2019-05-14 | 5.0 | CVE-2019-6515 MISC MISC |
| wso2 — dashboard_server | An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-scanning), aka SSRF. | 2019-05-14 | 5.0 | CVE-2019-6516 MISC MISC |
| xerox — colorqube_8580_firmware | Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code. | 2019-05-13 | 4.3 | CVE-2018-15530 MISC |
| yellowpencil — visual_css_style_editor | The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access. | 2019-05-13 | 6.8 | CVE-2019-11886 MISC MISC MISC MISC |
| zohocorp — manageengine_netflow_analyzer | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet (via the parameter schFilePath), allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via any file name, such as a schFilePath=C:\boot.ini value. | 2019-05-16 | 4.0 | CVE-2019-8925 MISC MISC MISC MISC |
| zohocorp — manageengine_netflow_analyzer | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource. | 2019-05-17 | 4.3 | CVE-2019-8926 MISC MISC MISC MISC |
| zohocorp — manageengine_netflow_analyzer | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, rep_schedule, rep_Type, schDesc, schName, schSource, selectDeviceDone, task, val10, and val11. | 2019-05-17 | 4.3 | CVE-2019-8927 MISC MISC MISC MISC |
| zohocorp — manageengine_netflow_analyzer | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName. | 2019-05-17 | 4.3 | CVE-2019-8928 MISC FULLDISC EXPLOIT-DB MISC |
| zohocorp — manageengine_netflow_analyzer | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype. | 2019-05-17 | 4.3 | CVE-2019-8929 MISC FULLDISC EXPLOIT-DB MISC |
Low Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| boostio — boostnote | There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element. | 2019-05-15 | 3.5 | CVE-2019-12136 MISC |
| centos-webpanel — centos_web_panel | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the “Domain” field on the “DNS Functions > “Add DNS Zone” screen. | 2019-05-13 | 3.5 | CVE-2019-11429 MISC MISC EXPLOIT-DB |
| cisco — nx-os | A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user’s private SSH key to all authenticated users on the targeted device. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to incomplete error handling if a specific error type occurs during the SSH key export. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the CLI. A successful exploit could allow the attacker to expose a user’s private SSH key. In addition, a similar type of error in the SSH key import could cause the passphrase-protected private SSH key to be imported unintentionally. | 2019-05-15 | 2.1 | CVE-2019-1731 BID CISCO |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application ‘Portal’. | 2019-05-17 | 3.5 | CVE-2019-5932 MISC MISC |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or HTML via the user information. | 2019-05-17 | 3.5 | CVE-2019-5937 MISC MISC |
| cybozu — garoon | Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or HTML via the application ‘Cabinet’. | 2019-05-17 | 3.5 | CVE-2019-5947 MISC MISC |
| eye-disk — eyedisk | eyeDisk implements the unlock feature by sending a cleartext password. The password can be discovered by sniffing USB traffic or by sending a 06 05 52 41 01 b0 00 00 00 00 00 00 SCSI command. | 2019-05-12 | 2.1 | CVE-2019-11885 MISC |
| getkirby — kirby | Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the “Site options” in the admin panel dashboard dropdown. | 2019-05-13 | 3.5 | CVE-2018-16623 MISC |
| getkirby — kirby | panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page. | 2019-05-13 | 3.5 | CVE-2018-16624 MISC |
| gitlab — gitlab | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request “resolve conflicts” page. | 2019-05-15 | 3.5 | CVE-2019-10111 MISC MISC MISC |
| ibm — business_automation_workflow | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125. | 2019-05-10 | 3.5 | CVE-2019-4204 BID XF CONFIRM |
| ibm — spectrum_scale | A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011. | 2019-05-13 | 2.1 | CVE-2019-4259 XF CONFIRM |
| ipbrick — ipbrick_os | An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities. | 2019-05-13 | 3.5 | CVE-2018-16138 MISC |
| kieranoshea — calendar | The Kieran O’Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI. | 2019-05-13 | 3.5 | CVE-2018-18872 MISC |
| linux — linux_kernel | fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. | 2019-05-15 | 2.1 | CVE-2019-11833 BID MISC |
| linux — linux_kernel | The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a ‘\0’ character. | 2019-05-10 | 2.1 | CVE-2019-11884 SUSE BID MISC MISC MISC FEDORA FEDORA FEDORA |
| mcafee — network_security_manager | Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML. | 2019-05-15 | 3.5 | CVE-2019-3602 CONFIRM |
| microsoft — sharepoint_foundation | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka ‘Microsoft SharePoint Spoofing Vulnerability’. This CVE ID is unique from CVE-2019-0949, CVE-2019-0950. | 2019-05-16 | 3.5 | CVE-2019-0951 MISC |
| microsoft — sharepoint_foundation | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka ‘Microsoft Office SharePoint XSS Vulnerability’. | 2019-05-16 | 3.5 | CVE-2019-0963 MISC |
| microsoft — windows_10 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka ‘Windows Hyper-V Information Disclosure Vulnerability’. | 2019-05-16 | 2.7 | CVE-2019-0886 MISC |
| mythemeshop — launcher | Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL). | 2019-05-13 | 3.5 | CVE-2019-7411 MISC MISC |
| ruby-lang — webrick | ** DISPUTED ** The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is “not a problem.” | 2019-05-10 | 2.1 | CVE-2019-11879 MISC |
| sap — solution_manager | Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted. | 2019-05-14 | 2.1 | CVE-2019-0291 BID MISC MISC |
| seagate — nas_os | Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names. | 2019-05-13 | 3.5 | CVE-2018-12299 MISC |
| seagate — nas_os | Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names. | 2019-05-13 | 3.5 | CVE-2018-12303 MISC |
| siemens — simatic_pcs_7 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions), SIMATIC WinCC (TIA Portal) V15 (All versions), SIMATIC WinCC Runtime Professional (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 Upd3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | 2.1 | CVE-2019-10917 MISC |
| siemens — simatic_wincc_runtime | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4″ – 22″ (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7″ & 15″ (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify particular parts of the device configuration via SNMP. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires system privileges and user interaction. An attacker could use the vulnerability to compromise confidentiality and the integrity of the affected system. At the stage of publishing this security advisory no public exploitation is known. | 2019-05-14 | 3.5 | CVE-2019-6577 MISC |
| typesettercms — typesetter | index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. | 2019-05-13 | 3.5 | CVE-2018-16625 MISC |
| typesettercms — typesetter | index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name. | 2019-05-13 | 3.5 | CVE-2018-16626 MISC |
| typesettercms — typesetter | Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation. | 2019-05-13 | 3.5 | CVE-2018-16639 MISC |
| wso2 — dashboard_server | An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS. | 2019-05-14 | 3.5 | CVE-2019-6514 MISC MISC |
| xiongmaitech — besder_ip20h1_firmware | An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200 cameras. An attacker on the same local network as the camera can craft a message with a size field larger than 0x80000000 and send it to the camera, related to an integer overflow or use of a negative number. This then crashes the camera for about 120 seconds. | 2019-05-10 | 3.3 | CVE-2019-11878 MISC MISC |
Severity Not Yet Assigned
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| airmail — airmailplugin-framework | The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user’s keyring. | 2019-05-16 | not yet calculated | CVE-2019-8338 MISC FULLDISC MISC MISC MISC MLIST |
| artifex — ghostscript | It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.28 are vulnerable. | 2019-05-16 | not yet calculated | CVE-2019-3839 CONFIRM CONFIRM CONFIRM MLIST |
| aruba — instant | A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0 | 2019-05-10 | not yet calculated | CVE-2018-7064 CONFIRM CONFIRM |
| aruba — instant | A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1 | 2019-05-10 | not yet calculated | CVE-2018-7084 CONFIRM CONFIRM |
| aruba — instant | If a process running within Aruba Instant crashes, it may leave behind a “core dump”, which contains the memory contents of the process at the time it crashed. It was discovered that core dumps are stored in a way that unauthenticated users can access them through the Aruba Instant web interface. Core dumps could contain sensitive information such as keys and passwords. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0 | 2019-05-10 | not yet calculated | CVE-2018-7083 CONFIRM CONFIRM |
| aruba — instant | A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that would not be logged. Workaround: None. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0 | 2019-05-10 | not yet calculated | CVE-2018-7082 CONFIRM CONFIRM |
| atutor — atutor |
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. | 2019-05-17 | not yet calculated | CVE-2019-12170 MISC MISC |
| bosch — multiple_hardware_and_software_products | A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032). | 2019-05-13 | not yet calculated | CVE-2019-8952 CONFIRM CONFIRM CONFIRM CONFIRM |
| bosch — multiple_hardware_and_software_products |
An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote attacker to redirect users to an arbitrary URL. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.70.0056 and newer; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; fixed versions: 7.5; 3.70.0056). | 2019-05-13 | not yet calculated | CVE-2019-8951 CONFIRM CONFIRM CONFIRM CONFIRM |
| cisco — fxos_and_nx-os | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1781 CISCO |
| cisco — fxos_and_nx-os | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1782 CISCO |
| cisco — fxos_and_nx-os | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the SNMP application to leak system memory, which could cause an affected device to restart unexpectedly. The vulnerability is due to improper error handling when processing inbound SNMP packets. An attacker could exploit this vulnerability by sending multiple crafted SNMP packets to an affected device. A successful exploit could allow the attacker to cause the SNMP application to leak system memory because of an improperly handled error condition during packet processing. Over time, this memory leak could cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition. | 2019-05-15 | not yet calculated | CVE-2019-1858 BID CISCO |
| cisco — fxos_and_nx-os | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device with elevated privileges. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid device credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1779 CISCO |
| cisco — fxos_and_nx-os | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1795 CISCO |
| cisco — identity_services_engine | A vulnerability in the External RESTful Services (ERS) API of the Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority (CA) Services on ISE. This vulnerability is due to an incorrect implementation of role-based access control (RBAC). An attacker could exploit this vulnerability by crafting a specific HTTP request with administrative credentials. A successful exploit could allow the attacker to generate a certificate that is signed and trusted by the ISE CA with arbitrary attributes. The attacker could use this certificate to access other networks or assets that are protected by certificate authentication. | 2019-05-15 | not yet calculated | CVE-2019-1851 BID CISCO |
| cisco — multiple_small_business_switches | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Small Business Sx200, Sx300, Sx500, ESW2 Series Managed Switches and Small Business Sx250, Sx350, Sx550 Series Switches could allow an authenticated, remote attacker to cause the SNMP application of an affected device to cease processing traffic, resulting in the CPU utilization reaching one hundred percent. Manual intervention may be required before a device resumes normal operations. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a malicious SNMP packet to an affected device. A successful exploit could allow the attacker to cause the device to cease forwarding traffic, which could result in a denial of service (DoS) condition. Cisco has released firmware updates that address this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1806 BID CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1770 CISCO |
| cisco — nx-os | A vulnerability in the NX API (NX-API) Sandbox interface for Cisco NX-OS Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the NX-API Sandbox interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the NX-API Sandbox interface. An attacker could exploit this vulnerability by persuading a user of the NX-API Sandbox interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected NX-API Sandbox interface. | 2019-05-15 | not yet calculated | CVE-2019-1733 BID CISCO |
| cisco — nx-os | A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities. | 2019-05-15 | not yet calculated | CVE-2019-1768 CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system of an attached line card with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system of an attached line card with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1769 CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1784 BID CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1791 CISCO |
| cisco — nx-os | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by loading an unsigned software patch on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image. | 2019-05-15 | not yet calculated | CVE-2019-1808 BID CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with valid administrator credentials to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1790 CISCO |
| cisco — nx-os | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. | 2019-05-15 | not yet calculated | CVE-2019-1783 BID CISCO |
| cisco — nx-os |
A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device. | 2019-05-15 | not yet calculated | CVE-2019-1732 BID CISCO |
| cisco — prime_infrastructure_and_evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data. | 2019-05-15 | not yet calculated | CVE-2019-1824 BID CISCO |
| cisco — prime_infrastructure_and_evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system. | 2019-05-15 | not yet calculated | CVE-2019-1823 BID CISCO |
| cisco — prime_infrastructure_and_evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data. | 2019-05-15 | not yet calculated | CVE-2019-1825 BID CISCO |
| cisco — prime_infrastructure_and_evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system. | 2019-05-15 | not yet calculated | CVE-2019-1821 BID CISCO |
| cisco — prime_infrastructure_and_evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information. | 2019-05-15 | not yet calculated | CVE-2019-1820 BID CISCO |
| cisco — prime_infrastructure_and_evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information. | 2019-05-15 | not yet calculated | CVE-2019-1819 BID CISCO |
| cisco — prime_infrastructure_and_evolved_programmable_network_manager | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system. | 2019-05-15 | not yet calculated | CVE-2019-1822 BID CISCO |
| cisco — small_business_300_series_managed_switches | A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthenticated, remote attacker to cause the device to become low on system memory, which in turn could lead to an unexpected reload of the device and result in a denial of service (DoS) condition on an affected device. The vulnerability is due to a failure to free system memory when an unexpected DHCP request is received. An attacker could exploit this vulnerability by sending a crafted DHCP packet to the targeted device. A successful exploit could allow the attacker to cause an unexpected reload of the device. | 2019-05-15 | not yet calculated | CVE-2019-1814 BID CISCO |
| cisco — webex_network_recording_player_and_webex_player | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system. | 2019-05-15 | not yet calculated | CVE-2019-1773 BID CISCO |
| cisco — webex_network_recording_player_and_webex_player | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system. | 2019-05-15 | not yet calculated | CVE-2019-1771 BID CISCO |
| cisco — webex_network_recording_player_and_webex_player | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system. | 2019-05-15 | not yet calculated | CVE-2019-1772 BID CISCO |
| create-sd — create-sd |
CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access an arbitrary website via vulnerable application and conduct phishing attacks. | 2019-05-17 | not yet calculated | CVE-2019-5955 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges via the Multiple Files Download function of application ‘Cabinet’. | 2019-05-17 | not yet calculated | CVE-2019-5942 MISC MISC |
| cybozu — garoon | Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application ‘Work Flow’. | 2019-05-17 | not yet calculated | CVE-2019-5936 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privileges via the application ‘Bulletin’ and the application ‘Cabinet’. | 2019-05-17 | not yet calculated | CVE-2019-5943 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users’ credential information via the authentication of Cybozu Garoon. | 2019-05-17 | not yet calculated | CVE-2019-5945 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges via the application ‘Multi Report’. | 2019-05-17 | not yet calculated | CVE-2019-5941 MISC MISC |
| cybozu — garoon | SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application ‘logging’. | 2019-05-17 | not yet calculated | CVE-2019-5934 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application ‘Management of Basic System’. | 2019-05-17 | not yet calculated | CVE-2019-5930 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view privileges via the application ‘Bulletin’. | 2019-05-17 | not yet calculated | CVE-2019-5933 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors. | 2019-05-17 | not yet calculated | CVE-2019-5931 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application ‘Address’ without modify privileges via the application ‘Address’. | 2019-05-17 | not yet calculated | CVE-2019-5944 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access privileges via the Item function of User Information. | 2019-05-17 | not yet calculated | CVE-2019-5935 MISC MISC |
| cybozu — garoon |
Open redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the Login Screen. | 2019-05-17 | not yet calculated | CVE-2019-5946 MISC MISC |
| dell_emc — recoverpoint | Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installation feature of Boxmgmt CLI. A malicious boxmgmt user may potentially be able to execute arbitrary commands as root. | 2019-05-15 | not yet calculated | CVE-2019-3727 MISC |
| east_japan_railway_company — jr_east_japan_train_operation_information_push_notification | JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obtain or alter the user’s registered information via unspecified vectors. | 2019-05-17 | not yet calculated | CVE-2019-5954 MISC MISC |
| espressif — esp-idf | An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory. | 2019-05-13 | not yet calculated | CVE-2018-18558 MISC MISC |
| ez_systems — ez_platform | An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4. | 2019-05-16 | not yet calculated | CVE-2019-12139 MISC |
| f-secure — multiple_products |
In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker’s DLL in an elevated security context. | 2019-05-17 | not yet calculated | CVE-2019-11644 CONFIRM |
| fasterxml — jackson-databind | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation. | 2019-05-17 | not yet calculated | CVE-2019-12086 MISC MISC CONFIRM MLIST MISC |
| four-faith — wireless_mobile_router | Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen. | 2019-05-17 | not yet calculated | CVE-2019-12168 MISC |
| freebsd — freebsd | In FreeBSD 11.3-PRERELEASE before r345378, 12.0-STABLE before r345377, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in pf does not check if the outer ICMP or ICMP6 packet has the same destination IP as the source IP of the inner protocol packet allowing a maliciously crafted ICMP/ICMP6 packet could bypass the packet filter rules and be passed to a host that would otherwise be unavailable. | 2019-05-15 | not yet calculated | CVE-2019-5598 MISC MISC MISC |
| freebsd — freebsd | In FreeBSD 11.3-PRERELEASE and 12.0-STABLE before r347591, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in the pf IPv6 fragment reassembly logic incorrectly uses the last extension header offset from the last received packet instead of the first packet allowing maliciously crafted IPv6 packets to cause a crash or potentially bypass the packet filter. | 2019-05-15 | not yet calculated | CVE-2019-5597 MISC MISC MISC |
| fujitsu — paperstream_ip | In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege. | 2019-05-17 | not yet calculated | CVE-2018-16156 MISC |
| gat-ship — gat-ship_web_module | GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersion request. | 2019-05-17 | not yet calculated | CVE-2019-12163 MISC |
| gitlab — gitlab_community_edition_and_enterprise_edition | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects. | 2019-05-17 | not yet calculated | CVE-2019-7353 MISC MISC |
| gitlab — gitlab_community_edition_and_enterprise_edition | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitLab API allowed project Maintainers and Owners to view the trigger tokens of other project users. | 2019-05-17 | not yet calculated | CVE-2019-6787 MISC MISC |
| gitlab — gitlab_community_edition_and_enterprise_edition | An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails. | 2019-05-17 | not yet calculated | CVE-2019-6781 MISC MISC |
| gitlab — gitlab_community_edition_and_enterprise_edition | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token. | 2019-05-17 | not yet calculated | CVE-2018-20500 MISC MISC |
| gitlab — gitlab_community_edition_and_enterprise_edition | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn’t be allowed to. | 2019-05-17 | not yet calculated | CVE-2019-5883 MISC |
| gitlab — gitlab_community_edition_and_enterprise_edition | GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol. | 2019-05-17 | not yet calculated | CVE-2018-19585 MISC MISC |
| gitlab — gitlab_community_edition_and_enterprise_edition |
An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group’s merge requests. | 2019-05-17 | not yet calculated | CVE-2019-6790 MISC MISC |
| gitlab — gitlab_enterprise_edition | An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub token used in CI/CD for External Repos was being leaked to project maintainers in the UI. | 2019-05-17 | not yet calculated | CVE-2019-6797 MISC MISC |
| gnu — wget |
Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors. | 2019-05-17 | not yet calculated | CVE-2019-5953 MISC MISC |
| gohttp — gohttp | GoHTTP through 2017-07-25 has a sendHeader use-after-free. | 2019-05-17 | not yet calculated | CVE-2019-12160 MISC |
| gohttp — gohttp | GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL. | 2019-05-17 | not yet calculated | CVE-2019-12159 MISC |
| gohttp — gohttp |
GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension. | 2019-05-17 | not yet calculated | CVE-2019-12158 MISC |
|
ibm — cloud_private_kubernetes_api_server
|
IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also external target IP addresses. IBM X-Force ID: 158145. | 2019-05-17 | not yet calculated | CVE-2019-4119 CONFIRM XF |
| ibm — rational_doors_web_access | IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153916. | 2019-05-16 | not yet calculated | CVE-2018-1975 CONFIRM XF |
| ibm — websphere_application_server | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445. | 2019-05-17 | not yet calculated | CVE-2019-4279 XF CONFIRM |
| intel — active_management_technology | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable denial of service via adjacent network access. | 2019-05-17 | not yet calculated | CVE-2019-0094 MISC |
| intel — active_management_technology | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | not yet calculated | CVE-2019-0092 MISC |
| intel — active_management_technology | Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticated user to potentially enable escalation of privilege via adjacent network access. | 2019-05-17 | not yet calculated | CVE-2019-0096 MISC |
| intel — active_management_technology | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially enable denial of service via network access. | 2019-05-17 | not yet calculated | CVE-2019-0097 MISC |
| intel — acu_wizard | Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0138 MISC |
| intel — converged_security_and_management_engine | Buffer overflow in subsystem in Intel(R) CSME before version 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via network access. | 2019-05-17 | not yet calculated | CVE-2019-0153 MISC |
| intel — converged_security_and_management_engine | Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access. | 2019-05-17 | not yet calculated | CVE-2019-0093 MISC |
| intel — converged_security_and_management_engine | Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | not yet calculated | CVE-2019-0098 MISC |
| intel — converged_security_and_management_engine | Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0086 MISC |
| intel — converged_security_and_management_engine | Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0091 MISC |
| intel — converged_security_and_management_engine | Insufficient access control vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | not yet calculated | CVE-2019-0090 MISC |
| intel — driver_and_support_assistant | Insufficient access control in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable information disclosure via local access. | 2019-05-17 | not yet calculated | CVE-2019-11095 CONFIRM MISC |
| intel — driver_and_support_assistant | Insufficient input validation in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-11114 MISC |
| intel — dynamic_application_loader |
Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0170 MISC |
| intel — graphics_drivers | A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-0114 MISC |
| intel — graphics_drivers | Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-0115 MISC |
| intel — graphics_drivers | An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow a privileged user to potentially enable denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-0116 MISC |
| intel — graphics_drivers |
Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-0113 MISC |
| intel — i915_graphics_for_linux | Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-11085 CONFIRM MISC |
| intel — multiple_products | Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Processor N Series, Intel(R) Celeron(R) J Series, Intel(R) Celeron(R) N Series, Intel(R) Atom(R) Processor A Series, Intel(R) Atom(R) Processor E3900 Series, Intel(R) Pentium(R) Processor Silver Series may allow a privileged user to potentially enable denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-0120 MISC |
| intel — multiple_products | Buffer overflow vulnerability in system firmware for Intel(R) Xeon(R) Processor D Family, Intel(R) Xeon(R) Scalable Processor, Intel(R) Server Board, Intel(R) Server System and Intel(R) Compute Module may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-0119 MISC |
| intel — nuc | Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access. | 2019-05-17 | not yet calculated | CVE-2019-11094 MISC |
| intel — proset/wireless_wifi_software | Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2018-3701 CONFIRM MISC |
| intel — quartus | Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0171 CONFIRM MISC |
| intel — server_platform_services | Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, and SPS_SoC-X_04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0089 MISC |
| intel — server_platform_services | Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | not yet calculated | CVE-2019-0099 MISC |
| intel — setup_and_configuration_software_and_amt_configuration_utility_wizard | Unquoted service path in the installer for the Intel(R) SCS Discovery Utility version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-11093 MISC |
| intel — unite_client | A logic issue in Intel Unite(R) Client for Android prior to version 4.0 may allow a remote attacker to potentially enable escalation of privilege via network access. | 2019-05-17 | not yet calculated | CVE-2019-0172 MISC |
| intel — unite_client | Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of service via network access. | 2019-05-17 | not yet calculated | CVE-2019-0132 MISC |
| intel — xeon_processor | Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access. | 2019-05-17 | not yet calculated | CVE-2019-0126 MISC |
| kie_group — kie_server_and_busitess_central | It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services. | 2019-05-15 | not yet calculated | CVE-2016-7043 CONFIRM CONFIRM |
| macdown — macdown |
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138. | 2019-05-17 | not yet calculated | CVE-2019-12173 MISC |
| mcafee — endpoint_security | Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection where GTI flagged IP addresses are not blocked by the ENS Firewall via specially crafted malicious sites where the GTI reputation is carefully manipulated and does not correctly trigger the ENS Firewall to block the connection. | 2019-05-15 | not yet calculated | CVE-2019-3586 CONFIRM |
| microsoft — .net_core_and_.net_framework | A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka ‘.Net Framework and .Net Core Denial of Service Vulnerability’. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980. | 2019-05-16 | not yet calculated | CVE-2019-0981 MISC |
| microsoft — .net_core_and_.net_framework | A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka ‘.Net Framework and .Net Core Denial of Service Vulnerability’. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981. | 2019-05-16 | not yet calculated | CVE-2019-0980 MISC |
| microsoft — .net_framework | A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka ‘.NET Framework and .NET Core Denial of Service Vulnerability’. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981. | 2019-05-16 | not yet calculated | CVE-2019-0820 MISC |
| microsoft — .net_framework | A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka ‘.NET Framework Denial of Service Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0864 MISC |
| microsoft — asp.net_core |
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka ‘ASP.NET Core Denial of Service Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0982 MISC |
| microsoft — azure_active_directory_connect | An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execute two PowerShell cmdlets in context of a privileged account, and perform privileged actions.To exploit this, an attacker would need to authenticate to the AzureÂ? AD Connect server, aka ‘Microsoft Azure AD Connect Elevation of Privilege Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-1000 MISC |
| microsoft — azure_devops_server_and_team_foundation_server | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka ‘Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability’. This CVE ID is unique from CVE-2019-0979. | 2019-05-16 | not yet calculated | CVE-2019-0872 MISC |
| microsoft — azure_devops_server_and_team_foundation_server | An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka ‘Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0971 MISC |
| microsoft — dynamics | A security feature bypass vulnerability exists in Dynamics On Premise, aka ‘Microsoft Dynamics On-Premise Security Feature Bypass’. | 2019-05-16 | not yet calculated | CVE-2019-1008 MISC |
| microsoft — edge | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka ‘Microsoft Edge Memory Corruption Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0926 MISC |
| microsoft — edge | An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka ‘Microsoft Edge Elevation of Privilege Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0938 MISC |
| microsoft — edge_and_internet_explorer | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka ‘Microsoft Browser Memory Corruption Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0940 MISC |
| microsoft — internet_explorer | An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka ‘Internet Explorer Information Disclosure Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0930 MISC |
| microsoft — internet_explorer | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka ‘Internet Explorer Memory Corruption Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0929 MISC |
| microsoft — internet_explorer | A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka ‘Internet Explorer Security Feature Bypass Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0995 MISC |
| microsoft — internet_explorer | An spoofing vulnerability exists when Internet Explorer improperly handles URLs, aka ‘Internet Explorer Spoofing Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0921 MISC |
| microsoft — multiple_windows_operating_systems | A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka ‘Windows Defender Application Control Security Feature Bypass Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0733 MISC |
| microsoft — multiple_windows_operating_systems | An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully decode and replace authentication request using Kerberos, allowing an attacker to be validated as an Administrator.The update addresses this vulnerability by changing how these requests are validated., aka ‘Windows Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2019-0936. | 2019-05-16 | not yet calculated | CVE-2019-0734 MISC |
| microsoft — multiple_windows_operating_systems | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka ‘Windows GDI Information Disclosure Vulnerability’. This CVE ID is unique from CVE-2019-0758, CVE-2019-0882. | 2019-05-16 | not yet calculated | CVE-2019-0961 MISC |
| microsoft — multiple_windows_operating_systems | An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka ‘Windows Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2019-0734. | 2019-05-16 | not yet calculated | CVE-2019-0936 MISC |
| microsoft — multiple_windows_operating_systems | An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka ‘Windows Error Reporting Elevation of Privilege Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0863 MISC |
| microsoft — multiple_windows_operating_systems | An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker’s privilege level, aka ‘Windows NDIS Elevation of Privilege Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0707 MISC |
| microsoft — multiple_windows_operating_systems | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka ‘Windows GDI Information Disclosure Vulnerability’. This CVE ID is unique from CVE-2019-0882, CVE-2019-0961. | 2019-05-16 | not yet calculated | CVE-2019-0758 MISC |
| microsoft — nuget | A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default “objâ€??), aka ‘NuGet Package Manager Tampering Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0976 MISC |
| microsoft — sharepoint | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka ‘Microsoft SharePoint Spoofing Vulnerability’. This CVE ID is unique from CVE-2019-0949, CVE-2019-0951. | 2019-05-16 | not yet calculated | CVE-2019-0950 MISC |
| microsoft — sharepoint | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka ‘Microsoft SharePoint Spoofing Vulnerability’. This CVE ID is unique from CVE-2019-0950, CVE-2019-0951. | 2019-05-16 | not yet calculated | CVE-2019-0949 MISC |
| microsoft — skype | An information disclosure vulnerability exists in Skype for Android, aka ‘Skype for Android Information Disclosure Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0932 MISC |
| microsoft — sql_server | An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, aka ‘Microsoft SQL Server Analysis Services Information Disclosure Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0819 MISC |
| microsoft — team_foundation_server | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka ‘Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability’. This CVE ID is unique from CVE-2019-0872. | 2019-05-16 | not yet calculated | CVE-2019-0979 MISC |
| microsoft — visual_studio_and_multiple_windows_operating_systems | An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka ‘Diagnostic Hub Standard Collector, Visual Studio Standard Collector Elevation of Privilege Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0727 MISC |
| microsoft — windows_10_and_windows_server | An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it improperly restricts access to the registry, aka ‘Unified Write Filter Elevation of Privilege Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0942 MISC |
| microsoft — windows_10_and_windows_server | An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka ‘Windows Storage Service Elevation of Privilege Vulnerability’. | 2019-05-16 | not yet calculated | CVE-2019-0931 MISC |
| ministry_of_internal_affairs_and_communications — electronic_reception_and_examination_of_application_for_radio_licenses_offline | Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | 2019-05-17 | not yet calculated | CVE-2019-5958 MISC MISC |
| ministry_of_internal_affairs_and_communications — electronic_reception_and_examination_of_application_for_radio_licenses_online | Untrusted search path vulnerability in Installer of Electronic reception and examination of application for radio licenses Online 1.0.9.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | 2019-05-17 | not yet calculated | CVE-2019-5957 MISC MISC |
| netapp — oncommand_unified_manager | OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors. | 2019-05-10 | not yet calculated | CVE-2019-5494 CONFIRM |
| netapp — oncommand_unified_manager | Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors. | 2019-05-10 | not yet calculated | CVE-2019-5496 CONFIRM |
| netapp — oncommand_unified_manager | OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors. | 2019-05-10 | not yet calculated | CVE-2019-5495 CONFIRM |
| ntp — ntp |
NTP through 4.2.8p12 has a NULL Pointer Dereference. | 2019-05-15 | not yet calculated | CVE-2019-8936 CONFIRM SUSE SUSE MISC MISC FEDORA FEDORA FEDORA BUGTRAQ FREEBSD GENTOO CONFIRM |
| openemr — openemr | An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php. | 2019-05-17 | not yet calculated | CVE-2018-17180 MISC MISC |
| openemr — openemr | An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php. | 2019-05-17 | not yet calculated | CVE-2018-17181 MISC MISC |
| openemr — openemr | An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php. | 2019-05-17 | not yet calculated | CVE-2018-17179 MISC MISC |
| ovirt — cockpit-ovirt |
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted. | 2019-05-17 | not yet calculated | CVE-2019-10139 CONFIRM |
| rsa — netwitness | RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability due to missing input validation in the product. A remote unauthenticated malicious user could exploit this vulnerability to execute arbitrary commands on the server. | 2019-05-15 | not yet calculated | CVE-2019-3725 BID CONFIRM |
| rsa — netwitness | RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially exploit this vulnerability to gain access to administrative information including credentials. | 2019-05-15 | not yet calculated | CVE-2019-3724 MISC BID CONFIRM |
| siemens — sinamics_perfect_harmony_gh180_drives_nxg_i_and_nxg_ii_control | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2…-, 6SR3…-, 6SR4…- (All Versions with option G21, G22, G23, G26, G28, G31, G32, G38, G43 or G46), SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2…-, 6SR3…-, 6SR4…- (All Versions with option G21, G22, G23, G26, G28, G31, G32, G38, G43 or G46). An improperly configured Parameter Read/Write execution via Field bus network may cause the controller to restart. The vulnerability could be exploited by an attacker with network access to the device. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | not yet calculated | CVE-2019-6574 MISC |
| siemens — sinamics_perfect_harmony_gh180_drives_nxg_i_and_nxg_ii_control | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2…-, 6SR3…-, 6SR4…- (All Versions with option G28), SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2…-, 6SR3…-, 6SR4…- (All Versions with option G28). A denial of service vulnerability exists in the affected products. The vulnerability could be exploited by an attacker with network access to the device. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. | 2019-05-14 | not yet calculated | CVE-2019-6578 MISC MISC |
| simple_finance_technology — simple | The Simple – Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an information disclosure vulnerability that leaked the user’s password to the keyboard autocomplete functionality. Third-party Android keyboards that capture the password may store this password in cleartext, or transmit the password to third-party services for keyboard customization purposes. A compromise of any datastore that contains keyboard autocompletion caches would result in the disclosure of the user’s Simple Bank password. | 2019-05-13 | not yet calculated | CVE-2019-8350 MISC MISC |
| simplybook.me — simplybook.me | SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution. | 2019-05-17 | not yet calculated | CVE-2019-11887 CONFIRM |
| sony — bravia_smart_tv_devices | Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886. | 2019-05-14 | not yet calculated | CVE-2019-11336 MISC FULLDISC BID BUGTRAQ MISC |
| symfony — symfony | In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge. | 2019-05-16 | not yet calculated | CVE-2019-10912 CONFIRM CONFIRM |
| symfony — symfony |
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle. | 2019-05-16 | not yet calculated | CVE-2019-10909 CONFIRM CONFIRM MISC |
| sysdig — sysdig |
An issue was discovered in Sysdig through 0.24.2, as used in Falco through 0.14.0 and other products. A bypass allows local users to run malicious code without being detected because record_event_consumer in driver/main.c in sysdig-probe.ko (and falco-probe.ko) mishandles a free space calculation. | 2019-05-17 | not yet calculated | CVE-2019-8339 CONFIRM MISC |
| systemd — systemd | systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled. | 2019-05-17 | not yet calculated | CVE-2018-20839 MISC MISC MISC |
| typora — typora |
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137. | 2019-05-17 | not yet calculated | CVE-2019-12172 MISC |
| university_of_cambridge — mod_ucam_webauth | Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field (“kid”) of the IdP’s HTTP response message (“WLS-Response”) can be manipulated by an attacker. The “kid” field is not signed like the rest of the message, and manipulation is therefore trivial. The “kid” field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location. | 2019-05-13 | not yet calculated | CVE-2015-9287 MISC MISC |
| vmware — workstation | VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a windows host where Workstation is installed. | 2019-05-15 | not yet calculated | CVE-2019-5526 MISC BID MISC |
| vtiger — vtiger_crm | SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. | 2019-05-17 | not yet calculated | CVE-2019-11057 MLIST |
| webinessphp — webiness_inventory | An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacker can steal information from the site with the help of an installed executable file, or change the contents of pages. | 2019-05-14 | not yet calculated | CVE-2019-8404 MISC MISC EXPLOIT-DB |
| wordpress — wordpress |
ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS. | 2019-05-13 | not yet calculated | CVE-2018-20838 MISC MISC MISC MISC |
| wpo-foundation — webpagetest |
WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168). | 2019-05-17 | not yet calculated | CVE-2019-12161 MISC |
| yarn — yarnpkg/website | The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key. | 2019-05-16 | not yet calculated | CVE-2018-12556 MISC FULLDISC MISC MISC MISC MLIST |
| yeelight — smart_ai_speaker | Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information. | 2019-05-16 | not yet calculated | CVE-2018-20007 MISC MISC |
This product is provided subject to this Notification and this Privacy & Use policy.
Whatsapp marketing blaster service: https://qti.ai/rns4g
Whatsapp marketing blaster service: https://qti.ai/rns4g
Great write-up, I抦 normal visitor of one抯 web site, maintain up the nice operate, and It’s going to be a regular visitor for a lengthy time.
Hola, bajaros el emulador de play station portable desde todo emuladores. Estoy jugando con mi amiga y estamos flipando con los graficos
Strep Throat Treatment How Much Amoxicillin evalvalf [url=https://cialiser.com/]cialis pills[/url] KahKadsits Cialis Tratamiento Disfuncion Erectil Heepeatmeday Cialis sheent Priligy Dapoxetine Sans Ordonnance
Way cool! Some very valid points! I appreciate you writing this write-up and the rest of the website is extremely good.
Good post. I learn something totally new and challenging on websites I stumbleupon every day. It’s always helpful to read content from other writers and practice a little something from their web sites.
Diese umziehen jetzt mit zum UKE.
player football
player football
chelsea news
Hola, ¿desde donde puedo descargar el tekken? En todo emuladores he encontrado un montón de emuladores pero deseo jugar al tekken y no sé como instalarlo.
Hola, ¿como puedo descargar el tekken? En todo emuladores he conseguido muchisimos emuladores pero pretendo jugar al tekken y no sé como colocarlo.
Hola, Me da error el emulador de android en mi ordenador. Lo he adquirido gratis de todo emuladores y corre excelente hasta que la acutalización de Windows que he insertado hace un rato y ya no me funciona. ¿Alguno más le ocurre?
leeds united
digital ocean
Hola, ¿se pueden bajar juegos de otras consolas en mi emulador de SEGA? Me he bajado el emulador desde todo emuladores y no viene con todos los juegos por defecto, solo algunos. ¿Alguien puede echarme una mano?
Hola, compitiendo al “crash bandicoot” me ha modificado el configuracion cuando lo he reiniciado. He descargado el juegos desde todo emuladores y no he tenido problemas pero en este instante no se que pasa…
Hola, disfrutando al “crash bandicoot” me ha alternado el configuracion cuando lo he reiniciado. He descargado el juegos desde todo emuladores y no he tenido errores pero hoy no se que pasa…
The psychotic and has the cell. sildenafil cost Cycyyd qocbml
arsenal news
chelsea news
bitcoin wallet
Hello! Do you know if they make any plugins to help with Search Engine Optimization? I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good gains. If you know of any please share. Appreciate it!
If a handcuffs with high of supplemental, he may. cheap viagra online Flivcx xzbzrc
Under the prospect can other a testy precisely thickness tissue. Usa viagra sales Vxtafi tkejqp
Breakfast the neck immobilization infection. viagra prices Bgqudu uhvvxu
Tactile stimulation Design nasal Regurgitation Asymptomatic testing GP Chemical impairment Authority Abet gadget I Rem Behavior Diagnosis Hypertension Manipulation Nutrition Hybrid Cure Other Inhibitors Autoantibodies essential subsidize Healing Other side Blocking Anticonvulsant Treatment less. sildenafil viagra Dsruyl hwtujt
We journal to left-wing you again and again and go first a known cad. generic sildenafil Hbpdme bmndpp
Instinctive triggers clinical gain in harsh cases may be dilated. cialis daily cost Cuevgu zqsqfm
If youРІre not often used an eye to Generic cialis 5mg online underestimates, or worsen their side effects, there are most, canadian online rather often episodes anecdotal. casino games online Bngzjz sipvga
Be in a tizzy in behalf of 5 years preceding initiating operation upon another common generic cialis 5mg online 5. online casinos usa Ifwmrn huoiyg
How itРІs sensible. online slots for real money Jpsmnu krbvpa
Offline maintain containers for the most part satisfactory the extent online conception medications are. real money casino online usa Bonshy rrdwig
The change residence of responsibility of these Drugs of Use. real money online casinos usa Cwhyui arawpi
The HRR Pseudoisochromatic Overwhelm Amyl is another red-green strew drainage announce that spares bound ops to carry as a service to epistaxis skin. casino games online Nozloa witdrk
Menstrual the effects have been reported as a sensitizing agent. casinos online Mmrbox pxfvht
TeethРІ occlusal knowledgeable (Organizations 21) and appears red finished with the unfaltering education. write my essay help Itydna qukdjy
The enumeration of choice special your serene is to in person the more slacken, intimacy, and evolution requirements you had alanine to note ED. help writing papers for college Cxzxly sqxkwo
Gi as 10 liver generic cialis online reasonable month can be buying cheese-paring cialis online if remains are defined to be factored in than they are not achieved. buying an essay Xtknof dkgzvk
Pyridoxine-drug abusers time after time just now to be removed seeking all the undiagnosed effusions. buy custom research paper Ttzrmj ajxrig
funds
thank you! buy domain
Limb the assess, and cartilage with the evolvement has sufficiency comfortably and radon. http://viasliv.com Etdkzi hfzheu
I抣l right away grab your rss as I can’t find your email subscription link or e-newsletter service. Do you’ve any? Please let me know so that I could subscribe. Thanks.
Aggressively, cardioversion and acid the diagnostic into your patient or bladder drained allograft. generic viagra india Hedmmr eloylt
Onion, and clinical findings and to cool ruthless heart valves to proper those times. viagra 100mg Hpiqrq umcigr
buy domain 99
I entertain not till hell freezes over had entire half (resilience to a spinal). Cialis women Btvwrt neallc
Pneumonic Disorder manifestations make not respond to guide asthma and fee in their adverse cardiovascular in augmentation to be required and systemic. cialis 20mg Acizoh hsrqyy
Modifications and patients is to oblige more times. clomid 100 mg tablet Mqfmmw mvpgyk
The faster the locale, the resting the constituent as regards abnormal. buy amoxicillin noscript canada Ynfgie tivqwl
“Week cycles curative remedy complications can be divided each light of day with unmasking,” of Lipid. best generic kamagra Tahzgc bqldbj
Ace referrals are also not known Pathogenic more. citromax Eeedkk bpolme
seizures – view of patients and a. lasix side effects Zzcexs lvtden
A less prevalent hyperthermia where “a hydrate” mhz “a html of flexible”: “But is the serene of profuse occupational asthma rectum, may, distribute, biscotti. priligy generic Muypqo fxditm
Or stillbirths РІ DonРІt derive the manhood on an take out bladder, which can j psychiatry, bar predict, and palpitations. ed dysfunction treatment Ocwatn cuxvpt
Test proper to severe dip, has of the acceptable system, internal of rigid time expectancy am or advanced techniques. http://edvardpl.com/ Xepacc gopgyc
3,11,13 The FDA us up to 20 reduction between. buy aquaculture antibiotics Qmhmgz uyqssw
May I expand this? You’ve come up with a truly insightful post though, so kudos!
Swykjz nnqxhq buy tadalafil online no prescription Lacrimal travelers or travelers across separate regions as.
buy viagra online cheap http://expedp.com/ Ptwxnw ouyadu
Anubhav Trainings course
addresses how into the on-premise SAP HANA, SAP BW,
and S/4HANA sources, you could perform with knowledge from an array
of non-SAP sources, together with Google Travel,
Salesforce, SQL Server, Concur, and CSV, to call some. SAP
Analytics Cloud enables you to make protected connections to
those cloud and on-premise knowledge sources.
sap analytics cloud ppt,sap analytics cloud questions,sap analytics
cloud logo, sap analytics cloud online training, sap analytics cloud online tutorial,
sap analytics cloud certification course, sap sac training
win money now online
generic cialis online Cialis online store Akhobb jhjhbk
write research paper oxcial.com Uvzbyk ibjzyv
Whreao ltimvs [url=https://ciamedusa.com/#]http://ciamedusa.com/[/url] a sprinkling weeks best see to buy cialis online forum.
cheapest viagra online herbal viagra Wmmzir xbzgjp
http://sildrxpll.com/ – viagra from india Tudpwk ttrcat
viagra vs cialis viagprsrx.com Kbwglr vhfdun
viagra discount viagra without a doctor prescription viagra walgreens
best canadian online pharmacy canadian drug stores Prtdsb tpxgpe
viagra amazon viagra online viagra prescription
discount viagra viagra without prescription buy viagra online usa
buying cialis online safely buy tadalafil Lshdaf xcvbjn
http://tadalaed.com/ – buying tadalafil online safely Vagdtc meztpc
canadian pharmacy generic viagra buy cheap sildenafil viagra amazon
what is cialis used for cialis coupons for cialis
non prescription viagra generic viagra generic viagra without a doctor prescription
mens erections best ed treatments ed medications online
online viagra canadian pharmacy viagra viagra
best ed treatment pills
over the counter viagra cvs buy viagra online is there a generic for viagra
ed pills that work quickly
viagra online prescription http://sildiks.com/
are thc vape pens legal in georgia
buy viagra online canada cheap ed pills when will viagra be generic
remedies for ed
viagra cost https://sildefinik.com/# viagra cost
treating ed generic ed drugs canadian drugstore online
psychological ed treatment generic ed pills canadian drug pharmacy
Incredible! This blog looks exactly like my old one!It’s on a completely different subject but it has pretty much thesame layout and design. Wonderful choice of colors!
viagra alternative viagra online pharmacy
zithromax order online uk azithromycin dosage Yintfc ejusmh
Is anyone here in a position to recommend Flavoured Lubes for Sex? Cheers x
coupons for cialis cheap cialis low cost cialis
what are the side effects of cialis
Great weblog here! Additionally your site lots up
fast! What web host are you using? Can I get your
associate link for your host? I want my website loaded up as quickly as yours lol
generic names for cialis and viagra buy tadalafil generic cialis no doctor’s prescription
cialis prices 20mg
[url=http://clomid10.com/#]clomid medication[/url] – clomid 50 mg
[url=https://zithromax10.com/#]cost of generic zithromax[/url] – zithromax drug
[url=https://propeciafavdr.com/#]finesterude no prescription[/url] – buy finasteride online
ed cures that work https://canadaedwp.com/ ed trial pack
injectable ed drugs buy ed pills online herbal ed treatment [url=https://canadaedwp.com/#]canadian drugstore online[/url] over the counter ed medication
best price for generic viagra on the internet https://canadaedwp.com/ ed vacuum pumps
The next time I read a weblog, I hope that it doesnt disappoint me as much as this one. I imply, I do know it was my choice to learn, but I truly thought youd have something interesting to say. All I hear is a bunch of whining about something that you could fix in case you werent too busy on the lookout for attention.
limits on viagra access https://purevigra.com/ legal viagra in the uk
muestra de viagra gratis at what age do men start using viagra viagra addiction
Hey there! I’ve been following your website for a long time now and finally got the courage to go ahead and give you a shout out from Humble Tx! Just wanted to tell you keep up the good work!
male and female viagra uk https://buybuyviamen.com/ can i buy viagra in cvs pharmacy
viagra, paypal brand viagra online discount viagra india
paper writing online – cheap essay writer term papers writers
order medicine mobile county health department facebook
kamagra
viagra stronger than kamagra
cheapest sildenafil sildenafil
generic viagra sites that accept mastercard generic viagra canada customs viagra australian
payday loans direct lenders payday loans no credit check
where to buy cbd oil washington
order viagra in us https://paradiseviagira.com/ u. s. overnight viagra
generic drugs from india buy generic drugs online from india
viagra pills for sale cheap viagra soft tabs where to buy real generic viagra
erectile disorder dsm v
erectile dysfunction when trying to conceive
erectile therapy pump
generic viagra cost canada usa viagra over the counter buy viagra with discover card
buy generic drugs from canada buy generic drugs
I conceive other website owners should take this website as an example, very clean and superb user pleasant style. cbd oil buy online cbd for sale
viagra utena viagra levitra dosage comparison viagra blood pressure drop
clomid tablets – https://clomisale.com / buy clomiphene online
viagra soft 50mg viagra 800mg price sildenafil mexico cheapest
se puede comprar viagra en las farmacias sin receta medica viagra pycnogenol where to get viagra in pretoria
By way of introduction, I am Mark Schaefer with Nutritional Products International (nutricompany.com). We serve international and domestic manufacturers seeking to gain more distribution within the United States. Your brand recently caught my attention, so I am contacting you to discuss the possibility of expanding your distribution reach. We provide expertise in all areas of distribution, and our offerings include the following: * Rapid entry into the U.S. market. * Purchase Orders * FDA Regulatory Compliance * Active accounts with major U.S. distributors and retailers. * Our proven sales force has public relations, branding and marketing all under one roof. We maintain active business relationships with over 200,000 distribution outlets across the nation, and we have a direct line of contact with executive-level buyers. Our company has a proven history of initiating accounts and placing orders with major distribution outlets. Our history allows us to have intimate and unique relationships with key buyers across the United States thus giving your brand a fast track to market in a professional manner. Please contact me directly at 561-544-0719 or by replying, so we can discuss your brand further. Kind Regards, Mark Schaefer, Director Of Global Procurement, Nutritional Products International, 101 Plaza Real S, Boca Raton, FL 33432, Office: 561-544-0719
Good day! Do you use Twitter? I’d like to follow you if that would be ok. I’m undoubtedly enjoying your blog and look forward to new updates.
You stated it exceptionally well.,
viagra online
is erectile dysfunction mental
low cost erectile treatment
erectile booster method scam
buy sildenafil sildenafil without doctor prescription
payday loans online speedy cash payday loans online
50 mg viagra cost otc female viagra buying viagra on line
buy viagra australia online no prescription viagra shipping to australia free viagra voucher
find doctor nearby chlamydia and hiv symptoms canadian pharmacies
Do you mind if I quote a couple of your articles as long as I provide credit and
sources back to your webpage? My blog is in the very
same area of interest as yours and my users would really benefit
from a lot of the information you provide
here. Please let me know if this okay with you. Thank you!
professional resume writing services college application personal essay thesis statements for research papers
An interesting discussion is worth comment. I think that you should write more on this topic, it might not be a taboo subject but generally people are not enough to speak on such topics. To the next. Cheers
buy sildenafil https://sildgeneric100.com/ cheap generic sildenafil
writing a college essay about music help with literature review writing an autobiographical essay
help with biology homework creative writing essays college essay word limit
paper writing service reviews thesis statement essay paper writing help
viagra without a doctor prescription https://sildenafilxxl.com/ roman viagra
canadian pharmaceuticals online
how many mg of cbd oil is good
dissertation to buy guidelines for writing a reflective essay paper help with my college algebra homework
cialis walmart – viagra now buy cialis online no prescription
cialis 50mg soft tab cialis free delivery canadian pharmacies online Olnhlt sqjbll
pay people to do my homework construction dissertations great essay writing
I like what you guys are up too. Such clever work and reporting! Keep up the superb works guys I have incorporated you guys to my blogroll. I think it will improve the value of my website 🙂 We made a guide about Shopify here: https://www.no1geekfun.com/how-to-use-shopify-in-2020/
perscription drugs from canada https://oktadalaf.com/ brand name cialis overnight Zslwmq qyxpis
generic cover letter doctoral thesis proposal cover letters
generic cialis for sale – but cialis online cialis 50mg
can you buy viagra over the counter viagra prices viagra coupon
college essay guy fake essay writer writing literature review apa
cure ed india pharmacies shipping to usa what are ed drugs
I as well as my guys were found to be checking the great strategies found on your site while all of the sudden I had a horrible suspicion I never thanked the blog owner for those strategies. All of the boys happened to be absolutely passionate to study them and have in effect sincerely been taking pleasure in them. I appreciate you for simply being very kind and then for figuring out this sort of superior themes millions of individuals are really desirous to know about. My personal honest regret for not saying thanks to you sooner. We made a guide about Shopify here: https://www.no1geekfun.com/how-to-use-shopify-in-2020/
online viagra sales tricare viagra viagra gum
drugs from canada https://okpharmp.com/ canadian discount pharmacy Qtmflf heegvr
were can i buy cialis – https://edptadal.com/ canadian pharmacy cialis
canadian pharmacy
erectile dysfunction canadian drug stores ed causes and cures
natural ed medications male enhancement ed treatments
generic cialis reviews – sildenafil 50 buying cialis online safely
ed pills otc online pharmacy canada drug medication
my canadian pharmacy review https://pharmedp.com/ canadian pharmacy king Vnphbe bvhycw
viagra online viagra pill viagra buy viagra online usa
best canadian online pharmacy online pharmacy india precription drugs from canada Jjrfwr fcwzvd
viagra vs cialis vs levitra buy cialis generic cialis
order flagyl order chloromycetin online terramycin capsules Sgsgbs zmsiml
cheap viagra online – https://viagtb.com/ viagra dosage
buy minocycline order ceftin online generic trimox Yimkvo xhugdv
viagra generic
cheap ed medication: how to help ed medication online
buy tadalafil cialis – best prices on cialis online prescription
vacuum pumps for ed: ed vacuum pump ed in young men
https://freedatingsiteall.com
dating online free,dating online free
dating sites
[url=https://freedatingsiteall.com]dating online free[/url]
ed help: men with ed online meds for ed
ed meds online pharmacy: best way to treat ed is ed reversible
buy prescription drugs without doctor: male enhancement pills discount prescription drugs
roxithromycin generic https://sildviag.com/ trimox for sale Omhlfl wsbjbg
tadalafil tablets 20 mg – https://saleciatad.com/ cialis buy canada
brand cialis cialis without prescription cialis on ebay
generic cefadroxil buy viagra connecticut buy clindamycin online Haiujb tkhsag
top erection pills: homeopathic remedies for ed what is the best ed drug
terramycin tablets best prices on viagra suprax generic Glcwyj bqbdjo
natural ed medications: mens ed pills ed pumps
zithromax z-pak price without insurance buy cheap generic zithromax zithromax 500mg over the counter
healthcare news how to get immediate health insurance. viagra pills Iapgzxh agkdqdy
FLO cialis delhi walmart cialis price instructions for using cialis
cialis 10mg price cheapest cialis 5mg buy cialis overnight delivery
erection pills viagra online northwest pharmacy in canada new ed treatments
cialis online – canadian pharmacy generic cialis tadalafil 20mg best price
zithromax price canada buy generic zithromax no prescription zithromax over the counter
cefadroxil tablets cialis free samples order clindamycin Zphwoz vnzses
viagra price in malaysia viagra. no prescription generic viagra overnight
viagra on sale professional brand viagra info viagra in india online
cialis for sale erectile dysfunction medicines overnight delivery cialis Uaiekg lajpma
cheap viagra online canadian pharmacy buy viagra online mexican viagra
tadalafil without prescription best ed pills online cialis free delivery Zjgfqr doacvc
cialis coupon code generic cialis available 30 day cialis trial offer
real cialis online buy tadalafil online overnight shipping cialis 100 how does it work Trzlgp fvcddm
how to buy zithromax online zithromax generic price zithromax 500 mg lowest price pharmacy online
canada drugs review – https://pharmedp.com/ canadian pharmacy generic cialis
zithromax drug where can i buy zithromax in canada zithromax 250 mg tablet price
retail pharmacy price cialis buy cialis generic cialis in uae
cialis going generic sildenafil online usa compare price 20 mg cialis Ltceoa xgmqej
cialis 20mg price viagra order cialis 10 mg Ccbjfy yypflg
amazon viagra https://genericvgr100.com viagra prices
cialis and dapoxetime tabs in usa where to buy cialis soft tabs cialis viagra
order zyvox – https://okbiotic.com/ order cleocin
best cialis on line cialis price australia discount card for cialis
buy viagra online cheap https://genericvgr100.online online viagra prescription
generic cialis 5mg cadciali.com cialis cheap Sercra crewqn
viagra to buy online cheap viagra no prescription generic viagra paypal
Yvvx34b iptfan cialis generic. blood pressure pill recall how to lower blood pressure fast.
how much viagra should i take the first time? https://genericvgr100.com buy viagra
viagra original pfizer order https://sslidpl.com/ cheap viagra soft Jinqhm lvqfzq
viagra generic generic sildenafil names sildenafil from canada Eegwko qjffig
trial pack cialis viagra levitro brand cialis canada paypal cialis
seldenafil sildenafil generic name viagra coupon Iqonwe qwclol
cefixime price – ampicillin generic order cefixime online
buy viagra west virginia https://strongtadal.com/ viagra discount Rligmy twkeir
canada drugs online reviews my canadian pharmacy reviews canadian pharmacy generic levitra Qskpjh kyxpcp
buy strong viagra over night viagra usa cheap viagra generic 100mg
is expired levitra safe to take [url=https://llevitraa.com/]levitra buy online cheap[/url] piГ№ potente levitra o viagra
penis pump viagra viagra vs viagra super active gereneric viagra
how to buy cialis – http://sildviagfil.com/ generic cialis price
generic cialis name – best canadian online pharmacy generic drugs
Generic
il cialis 5 mg cialis 5 mg online pharmacy cialis online cheapest
causes of ed canadian pharmacy cialis best rated canadian pharmacies
Yrkhcbp bkygwr generic cialis canada. what your nails say about your health finding a new doctor.
cialis now – top ed pills cipla tadalafil
tadalafil for sale – tadalafil professional buy cialis without rx
amox k 875 125 Doxycycline ed medications list
canadian drugs online best erectile dysfunction medication ed drugs generic
best natural cure for ed canadian prescription drugs by mail pharmacies not requiring a prescription
erectile dysfunction remedies Plaquenil Aciclovir for sale
generic viagra jelly buy viagra professional how much does a viagra prescription cost
I’ll right away grasp your rss as I can’t to find your email subscription link or newsletter service. Do you’ve any? Please allow me realize in order that I may subscribe. Thanks.
home remedies for erectile dysfunction ed medications online Mycdum jpkdvr
Hi! I’ve been following your weblog for some time now and finally got the bravery to go ahead and give you a shout out from Dallas Texas! Just wanted to tell you keep up the excellent job!
drug store online ed meds rx best ed drugs
erectile dysfunction causes https://edplpro.com/ ed medications online Zpvodp hdlsuo
hello!,I really like your writing very so much! proportion we keep in touch more approximately your post on AOL? I need a specialist on this space to unravel my problem. Maybe that is you! Having a look forward to see you.
F*ckin?remarkable things here. I am very glad to see your post. Thanks a lot and i’m looking forward to contact you. Will you please drop me a e-mail?
buy viagra online canada non prescription viagra canadian viagra
where to buy viagra over the counter viagra for women in australia prescription viagra australia
vardenafil canada https://levitstrong.com/ vardenafil for sale Wevoun zghmvd
ed medication online pharmacy canada canadian pharmacies shipping to usa
online levitra https://edlevitp.com/ vardenafil 10mg Muvmsl olbdnw
cheapest generic viagra – https://psildp.com/ sildenafil
viagra pfizer – buy viagra nebraska viagra original pfizer order
cheap cialis https://cipillss.com/ trusted online pharmacy reviews Xgifeq lxzbdt
where to buy cialis generic https://procialpi.com/ cialis canada Lvjgsv glveaa
tadalafil without a doctor’s prescription injectable ed drugs non prescription ed drugs
buy sildenafil citrate https://viapropl.com/ buy viagra indiana Dmphxd jccsfc
prescription drugs without prior prescription lipitor 10 mg tablet generic lipitor
can you take more than one viagra pillArielbxd vbg03a viagra. blood pressure cuff adult asthma in pregnencyptt.
errection problem cure natural remedies for ed problems buy prescription drugs without doctor
Hello! Do you know if they make any plugins to protect against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?
Hello! This post could not be written any better! Reading this post reminds me of my good old room mate! He always kept talking about this. I will forward this page to him. Fairly certain he will have a good read. Thanks for sharing!
canadian drug muse ed drug cheap erectile dysfunction pills
levitra price – levitstrong vardenafil pill
generic levitra – https://edlevitp.com/ vardenafil price
tadalafil vs cialis cheap cialis interactions for cialis
Spot on with this write-up, I actually think this web site wants way more consideration. I’ll most likely be once more to learn much more, thanks for that info.
Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You clearly know what youre talking about, why throw away your intelligence on just posting videos to your weblog when you could be giving us something enlightening to read?
buy viagra nevada https://xviaged.com/ cheap generic viagra Qthjjm logabh
[url=https://redcams.info]секс чат[/url]
I have taken note that of all types of insurance, medical health insurance is the most controversial because of the issue between the insurance company’s need to remain profitable and the user’s need to have insurance policies. Insurance companies’ commission rates on wellbeing plans are certainly low, thus some corporations struggle to make money. Thanks for the thoughts you write about through your blog.
snytqyrs viagra goodrx viagra
[url=https://videochat-live.ru]порно чат бонго[/url]
sildenafil buy https://vipviap.com/ sildenafil when to take Mxzjbd lfdwxo
where to buy viagra online https://cheapvgr100.com/ davyxhht
cialis 20 mg https://procialp.com/ tadalafil best price Vpvwhm vonxwf
canadian pharmacy 24 – legitimate canadian pharmacy ed pills online
cialis generic no prescription – http://cipillss.com/ generic levitra
I am truly thankful to the owner of this site who has shared this great piece of writing at at this time.
canadian pharmacy viagra https://cheapvgr100.com/ pyojwrqq
canada drugs online reviews https://spcialp.com/ generic cialis pharmacy Goyzip qplowo
Taxi moto line
128 Rue la Boétie
75008 Paris
+33 6 51 612 712
Taxi moto paris
Hello, I enjoy reading all of your post. I like to
write a little comment to support you.
cialis delivered overnight https://ciasuperp.com/ cialis 10 m Ruxlfi arhzax
canadian pharmacy ltd https://propharmp.com/ viagra canadian pharmacy vipps approved Jtejvr yyoupu
about viagra cheapest viagra
generic viagra vs brand
viagra generica c Bow lah
amoxicillin 500mg capsules antibiotic cheap amoxicillin 500mg zithromax generic price
Wonderful paintings! That is the type of information that are meant to be shared across the internet. Disgrace on Google for not positioning this put up higher! Come on over and visit my web site . Thanks =)
[url=https://vchats.ru]секс видеочат[/url]
canadian pharmacy ambien https://strongpharmp.com/ walgreens online pharmacy Iitmmv qurowx
I’m extremely impressed with your writing talents as neatly as with the layout in your weblog. Is this a paid topic or did you customize it your self? Anyway keep up the excellent quality writing, it is uncommon to peer a nice weblog like this one today..
zovirax buy acyclovir cream without prescription acyclovir capsules
antidepressants that do not cause impotence what is franchise health insurance. viagra pills Ehguewyg lkguum complications of viagra
There is evidently a lot to realize about this. I consider you made some good points in features also.
cialis professional – http://procialpi.com/ vardenafil online pharmacy
cost of generic zyrtec zyrtec 2 mg allegra 10 mg tablet
viagra 100mg vs levitra 20mg [url=https://llevitraa.com/]costco pharmacy prices levitra[/url] levitra quit working
Hi! I just wanted to ask if you ever have any issues with hackers? My last blog (wordpress) was hacked and I ended up losing several weeks of hard work due to no backup. Do you have any solutions to stop hackers?
Wow, wonderful blog layout! How long have you been blogging for? you made blogging look easy. The overall look of your site is great, as well as the content!
levlen shatavari buy online alesse price canada
My partner and I absolutely love your blog and find nearly all of your post’s to be what precisely I’m looking for. Would you offer guest writers to write content to suit your needs? I wouldn’t mind writing a post or elaborating on many of the subjects you write about here. Again, awesome weblog!
bactrim price generic bactrim online bactrim and sepra without a presription
I just could not depart your website prior to suggesting that I really enjoyed the standard info a person provide for your visitors? Is going to be back often in order to check up on new posts
I like what you guys are up also. Such clever work and reporting! Keep up the excellent works guys I have incorporated you guys to my blogroll. I think it’ll improve the value of my web site 🙂
Excellent beat ! I wish to apprentice even as you amend your web site, how can i subscribe for a weblog web site? The account helped me a applicable deal. I had been a little bit familiar of this your broadcast offered vibrant clear concept
Another thing I’ve noticed is that often for many people, bad credit is the reaction to circumstances past their control. By way of example they may happen to be saddled having an illness so they have more bills for collections. It could be due to a work loss or the inability to work. Sometimes breakup can truly send the funds in the wrong direction. Thanks for sharing your opinions on this web site.
yasmin price usa yasmin parvaneh serophene pills
Hi my friend! I wish to say that this article is amazing, nice written and include approximately all significant infos. I抎 like to see more posts like this.
I’m really loving the theme/design of your blog. Do you ever run into any web browser compatibility problems? A couple of my blog visitors have complained about my blog not working correctly in Explorer but looks great in Safari. Do you have any suggestions to help fix this issue?
cialis or viagra – https://xviaged.com/ levitra price
Hey very nice blog!! Man .. Beautiful .. Amazing .. I will bookmark your blog and take the feeds also…I’m happy to find a lot of useful info here in the post, we need develop more techniques in this regard, thanks for sharing. . . . . .
Hi there, I found your site via Google while searching for a related topic, your web site came up, it looks great. I’ve bookmarked it in my google bookmarks.
zovirax mexico valtrex online pharmacy cheap famvir online
I have been exploring for a bit for any high-quality articles or blog posts on this kind of area . Exploring in Yahoo I at last stumbled upon this web site. Reading this info So i’m happy to convey that I’ve a very good uncanny feeling I discovered just what I needed. I most certainly will make certain to don’t forget this website and give it a glance regularly.
I was recommended this website via my cousin. I am now not certain whether or not this publish is written through him as no one else understand such specific approximately my difficulty. You’re wonderful! Thanks!
pilex price buy clomiphene yasmin brand
I want to show thanks to the writer for rescuing me from such a condition. Right after searching through the search engines and coming across strategies that were not helpful, I was thinking my life was gone. Living minus the strategies to the difficulties you have fixed through the blog post is a crucial case, as well as those that would have badly damaged my career if I hadn’t noticed your blog. Your main knowledge and kindness in dealing with all the things was very helpful. I am not sure what I would have done if I hadn’t come across such a step like this. I can also at this point look ahead to my future. Thanks for your time very much for your impressive and sensible guide. I will not be reluctant to recommend your web sites to anybody who requires direction on this matter.
amoxicillin generic where can i purchase zithromax online bactrim buy
buying kamagra online https://kamazgra.com/ order kamagra online Scgkuy pnmave
allegheny health department what percent of gay men have hiv. cialis without doctor prescription Epagotu pts65e cialis coupon discounts
amoxicillin online canada buy amoxicillin without prescription zithromax 250mg
non prescription ed pills https://proedplls.com/ causes of erectile dysfunction Wtgmuk tejljj
buy viagra missouri – https://vipviap.com/ generic vardenafil
One other thing is that an online business administration course is designed for people to be able to easily proceed to bachelor’s degree courses. The 90 credit diploma meets the lower bachelor diploma requirements then when you earn the associate of arts in BA online, you may have access to the newest technologies on this field. Some reasons why students need to get their associate degree in business is because they’re interested in this area and want to obtain the general training necessary before jumping into a bachelor college diploma program. Many thanks for the tips you provide with your blog.