VYPR

CVEs

129,930 total · page 2172 of 2,599

AllCriticalHighKEV
  • CVE-2019-10266HigJul 26, 2019
    Ahsay
    Cloud Backup Suite
    risk 0.53cvss 7.5epss 0.13

    An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.

  • CVE-2019-10265HigJul 26, 2019
    Ahsay
    Cloud Backup Suite
    risk 0.49cvss 7.5epss 0.03

    An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to (for example) "C:" then one can browse the whole server.

  • CVE-2019-10264HigJul 26, 2019
    Ahsay
    Cloud Backup Suite
    risk 0.47cvss 7.2epss 0.01

    An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE.

  • CVE-2019-9492HigJul 26, 2019
    Trend Micro
    Officescan
    risk 0.51cvss 7.8epss 0.01

    A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and terminate the product's process - disabling endpoint protection. The attacker must have already gained authentication and have local access…

  • CVE-2019-13638HigJul 26, 2019
    GNU
    Patch
    risk 0.51cvss 7.8epss 0.04

    GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from…

  • CVE-2019-13565HigJul 26, 2019
    OpenLDAP
    Openldap
    risk 0.49cvss 7.5epss 0.05

    An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity…

  • CVE-2019-13386HigJul 26, 2019
    Centos Web Panel
    Centos Web Panel
    risk 0.57cvss 8.8epss 0.03

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.

  • CVE-2019-13382HigJul 26, 2019
    Techsmith
    Snagit
    risk 0.51cvss 7.8epss 0.02

    UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that…

  • CVE-2018-20857HigJul 26, 2019
    Zendesk
    Samlr
    risk 0.49cvss 7.5epss 0.01

    Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with [email protected] followed by <!---->. and then the attacker's domain name.

  • CVE-2018-20856HigJul 26, 2019
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.01

    An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.

  • CVE-2018-20854HigJul 26, 2019
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.00

    An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds read.

  • CVE-2019-5607HigJul 26, 2019
    FreeBSD
    FreeBSD
    risk 0.51cvss 7.8epss 0.01

    In FreeBSD 12.0-STABLE before r350222, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350223, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, rights transmitted over a domain socket did not properly release a reference on transmission…

  • CVE-2019-5606HigJul 26, 2019
    FreeBSD
    FreeBSD
    risk 0.51cvss 7.8epss 0.01

    In FreeBSD 12.0-STABLE before r349805, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r349806, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, code which handles close of a descriptor created by posix_openpt fails to undo a signal…

  • CVE-2019-5603HigJul 26, 2019
    FreeBSD
    FreeBSD
    risk 0.51cvss 7.8epss 0.01

    In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, system calls operating on file descriptors as part of mqueuefs did not properly release the…

  • CVE-2019-0202HigJul 26, 2019
    Apache
    Storm
    risk 0.49cvss 7.5epss 0.02

    The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these…

  • CVE-2019-11922HigJul 25, 2019
    Facebook
    Zstandard
    risk 0.53cvss 8.1epss 0.01

    A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

  • CVE-2019-10184HigJul 25, 2019
    Undertow Io
    Undertow
    risk 0.42cvss 7.5epss 0.03

    undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

  • CVE-2019-13483HigJul 25, 2019
    Auth0
    Passport-SharePoint
    risk 0.47cvss 7.3epss 0.01

    Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.

  • CVE-2019-1010127HigJul 25, 2019
    Vcftools
    Vcftools
    risk 0.51cvss 7.8epss 0.02

    VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The…

  • CVE-2019-2346HigJul 25, 2019
    Qualcomm
    Snapdragon Compute
    risk 0.51cvss 7.8epss 0.00

    Firmware is getting into loop of overwriting memory when scan command is given from host because of improper validation. in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and…

  • CVE-2019-2345HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.46cvss 7.0epss 0.00

    Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD…

  • CVE-2019-2334HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.49cvss 7.5epss 0.01

    Null pointer dereferencing can happen when playing the clip with wrong block group id in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150,…

  • CVE-2019-2328HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Possible buffer overflow when number of channels passed is more than size of channel mapping array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in…

  • CVE-2019-2326HigJul 25, 2019
    Qualcomm
    MDM9150
    risk 0.51cvss 7.8epss 0.00

    Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &…

  • CVE-2019-2316HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.57cvss 8.8epss 0.00

    When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9640, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD…

  • CVE-2019-2314HigJul 25, 2019
    Qualcomm
    Snapdragon Compute
    risk 0.46cvss 7.0epss 0.00

    Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405,…

  • CVE-2019-2312HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

  • CVE-2019-2308HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote subsystem in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon…

  • CVE-2019-2306HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in…

  • CVE-2019-2301HigJul 25, 2019
    Qualcomm
    IPQ4019
    risk 0.51cvss 7.8epss 0.00

    Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019,…

  • CVE-2019-2299HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    An out-of-bound write can be triggered by a specially-crafted command supplied by a userspace application. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,…

  • CVE-2019-2298HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206,…

  • CVE-2019-2293HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Pointer dereference while freeing IFE resources due to lack of length check of in port resource. in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435,…

  • CVE-2019-2290HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Multiple open and close from multiple threads will lead camera driver to access destroyed session data pointer in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9640,…

  • CVE-2019-2281HigJul 25, 2019
    Qualcomm
    Snapdragon Compute
    risk 0.51cvss 7.8epss 0.00

    An unauthenticated bitmap image can be loaded in to memory and subsequently cause execution of unverified code. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD…

  • CVE-2019-2278HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD…

  • CVE-2019-2273HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.49cvss 7.5epss 0.01

    IOMMU page fault while playing h265 video file leads to denial of service issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W,…

  • CVE-2019-2272HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Buffer overflow can occur in display function due to lack of validation of header block size set by user. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206,…

  • CVE-2019-2263HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Access to freed memory can happen while reading from diag driver due to use after free issue in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking…

  • CVE-2019-2238HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Lack of check of data type can lead to subsequent loop-expression potentially go negative and the condition will still evaluate to true leading to buffer underflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,…

  • CVE-2019-2235HigJul 25, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…

  • CVE-2019-14270HigJul 25, 2019
    Comodo
    Internet Security
    risk 0.46cvss 7.1epss 0.00

    Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container feature, are vulnerable to Sandbox Escape.

  • CVE-2018-13897HigJul 25, 2019
    Qualcomm
    dnsmasq
    risk 0.49cvss 7.5epss 0.01

    Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206,…

  • CVE-2019-14266HigJul 25, 2019
    OpenSNS
    OpenSNS
    risk 0.57cvss 8.8epss 0.01

    OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php.

  • CVE-2019-4415HigJul 25, 2019
    IBM
    Cloud Private
    risk 0.51cvss 7.8epss 0.00

    IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM X-Force ID: 162706.

  • CVE-2019-4212HigJul 25, 2019
    IBM
    QRadar SIEM
    risk 0.57cvss 8.8epss 0.01

    IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159132.

  • CVE-2019-1010172HigJul 25, 2019
    Jsish
    Jsish
    risk 0.49cvss 7.5epss 0.01

    Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component is: function jsiValueGetString (jsiUtils.c). The attack vector is: executing crafted javascript code. The fixed version is: after commit…

  • CVE-2019-14262HigJul 25, 2019
    Metadataextractor Project
    Metadataextractor
    risk 0.49cvss 7.5epss 0.02

    MetadataExtractor 2.1.0 allows stack consumption.

  • CVE-2019-3622HigJul 24, 2019
    McAfee
    Data Loss Prevention Endpoint
    risk 0.53cvss 8.2epss 0.00

    Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder allowing privileged…

  • CVE-2019-10982HigJul 24, 2019
    Delta Electronics
    CNCSoft ScreenEditor
    risk 0.51cvss 7.8epss 0.01

    Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input…