| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-13738 | Med | 0.42 | 6.5 | 0.01 | Dec 10, 2019 | Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. | ||
| CVE-2019-13737 | Med | 0.42 | 6.5 | 0.01 | Dec 10, 2019 | Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | ||
| CVE-2019-13736 | Hig | 0.57 | 8.8 | 0.02 | Dec 10, 2019 | Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | ||
| CVE-2019-13735 | Hig | 0.57 | 8.8 | 0.02 | Dec 10, 2019 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
| CVE-2019-13734 | Hig | 0.58 | 8.8 | 0.04 | Dec 10, 2019 | Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2019-13732 | Hig | 0.57 | 8.8 | 0.01 | Dec 10, 2019 | Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2019-13730 | Hig | 0.57 | 8.8 | 0.02 | Dec 10, 2019 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2019-13729 | Hig | 0.57 | 8.8 | 0.01 | Dec 10, 2019 | Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2019-13728 | Hig | 0.57 | 8.8 | 0.02 | Dec 10, 2019 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2019-13727 | Hig | 0.57 | 8.8 | 0.01 | Dec 10, 2019 | Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page. | ||
| CVE-2019-13726 | Hig | 0.57 | 8.8 | 0.02 | Dec 10, 2019 | Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | ||
| CVE-2019-13725 | Hig | 0.57 | 8.8 | 0.02 | Dec 10, 2019 | Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | ||
| CVE-2019-5843 | Hig | 0.57 | 8.8 | 0.01 | Dec 10, 2019 | Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2019-5841 | Hig | 0.57 | 8.8 | 0.01 | Dec 10, 2019 | Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2019-17270 | Cri | 0.68 | 9.8 | 0.58 | Dec 10, 2019 | Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects… | ||
| CVE-2019-13672 | Med | 0.42 | 6.5 | 0.01 | Dec 10, 2019 | Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page on iOS. | ||
| CVE-2019-19703 | Med | 0.33 | 6.1 | 0.01 | Dec 10, 2019 | In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location. | ||
| CVE-2019-19702 | Hig | 0.42 | 7.5 | 0.01 | Dec 10, 2019 | The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the… | ||
| CVE-2012-1577 | Cri | 0.64 | 9.8 | 0.02 | Dec 10, 2019 | lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. | ||
| CVE-2019-6192 | Med | 0.32 | 4.4 | 0.02 | Dec 10, 2019 | A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow which could cause a denial of service. | ||
| CVE-2019-6183 | Hig | 0.49 | 7.5 | 0.02 | Dec 10, 2019 | A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that could cause systems to experience a blue screen error. Lenovo Energy Management is a client utility. Lenovo XClarity Energy Manager is not… | ||
| CVE-2016-1000107 | Med | 0.40 | 6.1 | 0.01 | Dec 10, 2019 | inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP… | ||
| CVE-2013-1689 | Med | 0.42 | 6.5 | 0.01 | Dec 10, 2019 | Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames. | ||
| CVE-2019-4663 | Med | 0.35 | 5.4 | 0.01 | Dec 10, 2019 | IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2019-4521 | Cri | 0.64 | 9.8 | 0.03 | Dec 10, 2019 | Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179. | ||
| CVE-2019-4244 | Cri | 0.59 | 9.1 | 0.02 | Dec 10, 2019 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installations due to missing authentication. IBM X-Force ID: 159518. | ||
| CVE-2019-4095 | Med | 0.28 | 4.3 | 0.00 | Dec 10, 2019 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015. | ||
| CVE-2019-19251 | Med | 0.35 | 5.3 | 0.01 | Dec 10, 2019 | The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts. | ||
| CVE-2016-1000108 | Med | 0.33 | 6.1 | 0.01 | Dec 10, 2019 | yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI… | ||
| CVE-2013-4184 | Med | 0.36 | 5.5 | 0.01 | Dec 10, 2019 | Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks | ||
| CVE-2013-4133 | Hig | 0.49 | 7.5 | 0.03 | Dec 10, 2019 | kde-workspace before 4.10.5 has a memory leak in plasma desktop | ||
| CVE-2013-4120 | Hig | 0.49 | 7.5 | 0.01 | Dec 10, 2019 | Katello has a Denial of Service vulnerability in API OAuth authentication | ||
| CVE-2013-2183 | Hig | 0.46 | 7.1 | 0.00 | Dec 10, 2019 | Monkey HTTP Daemon has local security bypass | ||
| CVE-2013-2167 | Cri | 0.57 | 9.8 | 0.02 | Dec 10, 2019 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass | ||
| CVE-2013-2166 | Cri | 0.57 | 9.8 | 0.02 | Dec 10, 2019 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass | ||
| CVE-2013-2159 | Cri | 0.57 | 9.8 | 0.03 | Dec 10, 2019 | Monkey HTTP Daemon: broken user name authentication | ||
| CVE-2014-3656 | Med | 0.33 | 6.1 | 0.01 | Dec 10, 2019 | JBoss KeyCloak: XSS in login-status-iframe.html | ||
| CVE-2013-2095 | Cri | 0.64 | 9.8 | 0.03 | Dec 10, 2019 | rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection | ||
| CVE-2013-1793 | Hig | 0.49 | 7.5 | 0.01 | Dec 10, 2019 | openstack-utils openstack-db has insecure password creation | ||
| CVE-2013-0293 | Hig | 0.51 | 7.8 | 0.00 | Dec 10, 2019 | oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation | ||
| CVE-2019-19698 | Med | 0.42 | 6.5 | 0.01 | Dec 10, 2019 | marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c. | ||
| CVE-2019-4621 | Cri | 0.64 | 9.8 | 0.02 | Dec 9, 2019 | IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883. | ||
| CVE-2019-4612 | Hig | 0.57 | 8.8 | 0.01 | Dec 9, 2019 | IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523. | ||
| CVE-2019-4611 | Med | 0.35 | 5.4 | 0.01 | Dec 9, 2019 | IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2019-4428 | Med | 0.35 | 5.4 | 0.01 | Dec 9, 2019 | IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure… | ||
| CVE-2019-19230 | Cri | 0.64 | 9.8 | 0.04 | Dec 9, 2019 | An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code. | ||
| CVE-2013-0342 | Med | 0.21 | 4.3 | 0.02 | Dec 9, 2019 | The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294. | ||
| CVE-2015-7892 | Hig | 0.54 | 7.8 | 0.01 | Dec 9, 2019 | Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.buf_out.num_planes value in an ioctl call. | ||
| CVE-2015-3425 | Med | 0.40 | 6.1 | 0.01 | Dec 9, 2019 | Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary web script or HTML via the ctl00$cph_content$_uig_formState parameter. | ||
| CVE-2015-3424 | Hig | 0.57 | 8.8 | 0.02 | Dec 9, 2019 | SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute arbitrary SQL commands via the SIDX parameter. |
- risk 0.42cvss 6.5epss 0.01
Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- risk 0.42cvss 6.5epss 0.01
Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.02
Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- risk 0.57cvss 8.8epss 0.02
Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- risk 0.58cvss 8.8epss 0.04
Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.01
Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.02
Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.01
Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.02
Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.01
Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.02
Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.02
Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.01
Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.01
Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.68cvss 9.8epss 0.58
Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects…
- risk 0.42cvss 6.5epss 0.01
Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page on iOS.
- risk 0.33cvss 6.1epss 0.01
In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
- risk 0.42cvss 7.5epss 0.01
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the…
- risk 0.64cvss 9.8epss 0.02
lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
- risk 0.32cvss 4.4epss 0.02
A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow which could cause a denial of service.
- risk 0.49cvss 7.5epss 0.02
A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that could cause systems to experience a blue screen error. Lenovo Energy Management is a client utility. Lenovo XClarity Energy Manager is not…
- risk 0.40cvss 6.1epss 0.01
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP…
- risk 0.42cvss 6.5epss 0.01
Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.
- risk 0.35cvss 5.4epss 0.01
IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.64cvss 9.8epss 0.03
Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179.
- risk 0.59cvss 9.1epss 0.02
IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installations due to missing authentication. IBM X-Force ID: 159518.
- risk 0.28cvss 4.3epss 0.00
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.
- risk 0.35cvss 5.3epss 0.01
The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts.
- risk 0.33cvss 6.1epss 0.01
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI…
- risk 0.36cvss 5.5epss 0.01
Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks
- risk 0.49cvss 7.5epss 0.03
kde-workspace before 4.10.5 has a memory leak in plasma desktop
- risk 0.49cvss 7.5epss 0.01
Katello has a Denial of Service vulnerability in API OAuth authentication
- risk 0.46cvss 7.1epss 0.00
Monkey HTTP Daemon has local security bypass
- risk 0.57cvss 9.8epss 0.02
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
- risk 0.57cvss 9.8epss 0.02
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass
- risk 0.57cvss 9.8epss 0.03
Monkey HTTP Daemon: broken user name authentication
- risk 0.33cvss 6.1epss 0.01
JBoss KeyCloak: XSS in login-status-iframe.html
- risk 0.64cvss 9.8epss 0.03
rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
- risk 0.49cvss 7.5epss 0.01
openstack-utils openstack-db has insecure password creation
- risk 0.51cvss 7.8epss 0.00
oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation
- risk 0.42cvss 6.5epss 0.01
marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
- risk 0.64cvss 9.8epss 0.02
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.
- risk 0.57cvss 8.8epss 0.01
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
- risk 0.35cvss 5.4epss 0.01
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.35cvss 5.4epss 0.01
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…
- risk 0.64cvss 9.8epss 0.04
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.
- risk 0.21cvss 4.3epss 0.02
The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
- risk 0.54cvss 7.8epss 0.01
Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.buf_out.num_planes value in an ioctl call.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary web script or HTML via the ctl00$cph_content$_uig_formState parameter.
- risk 0.57cvss 8.8epss 0.02
SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute arbitrary SQL commands via the SIDX parameter.