VYPR

CVEs

129,925 total · page 2191 of 2,599

  • CVE-2019-12274HigJun 6, 2019
    risk 0.57cvss 8.8epss 0.01

    In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive…

  • CVE-2019-8320HigJun 6, 2019
    risk 0.48cvss 7.4epss 0.04

    A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a…

  • CVE-2019-5242HigJun 6, 2019
    risk 0.51cvss 7.8epss 0.01

    There is a code execution vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker can tricking a user to install and run a malicious application to exploit this vulnerability. Successful exploitation may cause the attacker to execute malicious…

  • CVE-2019-5241HigJun 6, 2019
    risk 0.51cvss 7.8epss 0.01

    There is a privilege escalation vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker can tricking a user to install and run a malicious application to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a…

  • CVE-2019-5216HigJun 6, 2019
    risk 0.46cvss 7.0epss 0.01

    There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156(C00E156R1P20T8) and Honor Play smartphones versions earlier than…

  • CVE-2019-12134HigJun 6, 2019
    risk 0.57cvss 8.8epss 0.01

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export.

  • CVE-2019-11080HigJun 6, 2019
    risk 0.61cvss 8.8epss 0.14

    Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.

  • CVE-2019-4185HigJun 6, 2019
    risk 0.54cvss 8.3epss 0.01

    IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. IBM X-Force ID: 158975.

  • CVE-2019-9156HigJun 5, 2019
    risk 0.52cvss 8.0epss 0.03

    Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.

  • CVE-2019-7672HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges.

  • CVE-2019-6800HigJun 5, 2019
    risk 0.49cvss 7.5epss 0.01

    In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject…

  • CVE-2019-12494HigJun 5, 2019
    risk 0.55cvss 8.5epss 0.02

    In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.

  • CVE-2019-9189HigJun 5, 2019
    risk 0.61cvss 8.8epss 0.11

    Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an…

  • CVE-2019-9187HigJun 5, 2019
    risk 0.49cvss 7.5epss 0.02

    ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.

  • CVE-2019-12276HigJun 5, 2019
    risk 0.56cvss 7.5epss 0.60

    A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for…

  • CVE-2019-11987HigJun 5, 2019
    risk 0.51cvss 7.8epss 0.00

    A security vulnerability in HPE Smart Update Manager (SUM) prior to v8.4 could allow local unauthorized elevation of privilege.

  • CVE-2019-1868HigJun 5, 2019
    risk 0.49cvss 7.5epss 0.02

    A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information. The vulnerability is due to improper access control to files within the web-based management interface. An…

  • CVE-2019-1861HigJun 5, 2019
    risk 0.47cvss 7.2epss 0.04

    A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit…

  • CVE-2019-1845HigJun 5, 2019
    risk 0.56cvss 8.6epss 0.05

    A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a…

  • CVE-2019-12555HigJun 5, 2019
    risk 0.49cvss 7.5epss 0.01

    In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.

  • CVE-2019-12554HigJun 5, 2019
    risk 0.49cvss 7.5epss 0.01

    In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.

  • CVE-2019-11983HigJun 5, 2019
    risk 0.46cvss 7.0epss 0.01

    A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.

  • CVE-2019-11982HigJun 5, 2019
    risk 0.54cvss 8.3epss 0.02

    A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.

  • CVE-2019-9730HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.01

    Incorrect access control in the CxUtilSvc component of the Synaptics Sound Device drivers prior to version 2.29 allows a local attacker to increase access privileges to the Windows Registry via an unpublished API.

  • CVE-2019-9673HigJun 5, 2019
    risk 0.58cvss 8.8epss 0.04

    Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI.

  • CVE-2019-12742HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.01

    Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).

  • CVE-2019-11986HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11985HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11984HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11980HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A remote code exection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11979HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11978HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11977HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11976HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11975HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11974HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11973HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11972HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11971HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11970HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A SQL injection code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11969HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11968HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.03

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11967HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.03

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11966HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.02

    A remote privilege escalation vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11965HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11964HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11963HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11962HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11961HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  • CVE-2019-11960HigJun 5, 2019
    risk 0.57cvss 8.8epss 0.04

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.