VYPR

CVEs

408,147 total · page 5730 of 8,163

AllCriticalHighKEV
  • CVE-2019-1010162MedJul 23, 2019
    Jsish
    Jsish
    risk 0.36cvss 5.5epss 0.01

    jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcmpDict (jsiChar.c:121). The attack vector is: The victim must execute crafted javascript code. The fixed version is: 2.4.77.

  • CVE-2019-1010155CriJul 23, 2019
    Dlink
    Dsl 2750u Firmware
    risk 0.60cvss 9.1epss 0.09

    D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication,…

  • CVE-2019-1010153CriJul 23, 2019
    Zzcms
    Zzcms
    risk 0.64cvss 9.8epss 0.02

    zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.

  • CVE-2019-1010152CriJul 23, 2019
    Zzcms
    Zzcms
    risk 0.64cvss 9.8epss 0.02

    zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.

  • CVE-2019-1010150CriJul 23, 2019
    Zzcms
    Zzcms
    risk 0.64cvss 9.8epss 0.02

    zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.

  • CVE-2019-1010149CriJul 23, 2019
    Zzcms
    Zzcms
    risk 0.64cvss 9.8epss 0.02

    zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.

  • CVE-2019-1010148CriJul 23, 2019
    Zzcms
    Zzcms
    risk 0.64cvss 9.8epss 0.02

    zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.

  • CVE-2019-14241HigJul 23, 2019
    Haproxy
    Haproxy
    risk 0.54cvss 7.5epss 0.70

    HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.

  • CVE-2019-10173CriJul 23, 2019
    Xstream
    Xstream
    risk 0.71cvss 9.8epss 0.95

    It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported…

  • CVE-2019-1010124MedJul 23, 2019
    WebAppick
    Woocommerce Product Feed
    risk 0.38cvss 5.4epss 0.03

    WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.

  • CVE-2019-1010123HigJul 23, 2019
    Modx
    Revolution
    risk 0.49cvss 7.5epss 0.01

    MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web…

  • CVE-2019-14240HigJul 23, 2019
    wCMS
    wCMS
    risk 0.53cvss 8.1epss 0.01

    WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI.

  • CVE-2019-12552MedJul 22, 2019
    Sweetscape
    010 Editor
    risk 0.36cvss 5.5epss 0.01

    In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.

  • CVE-2019-12551MedJul 22, 2019
    Sweetscape
    010 Editor
    risk 0.36cvss 5.5epss 0.02

    In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.

  • CVE-2019-3414MedJul 22, 2019
    Zte
    OTCP
    risk 0.31cvss 4.8epss 0.00

    All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the…

  • CVE-2019-12328CriJul 22, 2019
    Atcom
    A10W
    risk 0.59cvss 9.0epss 0.04

    A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters…

  • CVE-2019-12327HigJul 22, 2019
    The Akuvox Company
    R50P VoIP phone
    risk 0.47cvss 7.2epss 0.02

    Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed.

  • CVE-2019-1010220LowJul 22, 2019
    Tcpdump
    Tcpdump
    risk 0.22cvss 3.3epss 0.01

    tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". The attack vector is:…

  • CVE-2019-1010218HigJul 22, 2019
    Cherokee
    Cherokee Web Server
    risk 0.49cvss 7.5epss 0.01

    Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv[0] to an insane length with execl. The fixed version…

  • CVE-2019-13097HigJul 22, 2019
    Cat Runner Decorate Home
    Cat Runner Decorate Home
    risk 0.49cvss 7.5epss 0.01

    The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server.

  • CVE-2019-13096CriJul 22, 2019
    TronLink
    Wallet
    risk 0.64cvss 9.8epss 0.01

    TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/.xml to gain unauthorized access.

  • CVE-2019-12326HigJul 22, 2019
    The Akuvox Company
    R50P
    risk 0.47cvss 7.2epss 0.03

    Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution.

  • CVE-2019-1010228CriJul 22, 2019
    Dcmtk
    Dcmtk
    risk 0.64cvss 9.8epss 0.08

    OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g.…

  • CVE-2019-13100MedJul 22, 2019
    Send Anywhere
    Send Anywhere
    risk 0.42cvss 6.5epss 0.01

    The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out the username/password of a valid user via /data/data/com.estmob.android.sendanywhere/shared_prefs/sendanywhere_…

  • CVE-2019-13099MedJul 22, 2019
    Momo
    Momo
    risk 0.42cvss 6.5epss 0.01

    The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out the username/password of a valid user and a user's access token via Logcat.

  • CVE-2019-13098MedJul 22, 2019
    TronLink
    Wallet
    risk 0.42cvss 6.5epss 0.01

    The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior…

  • CVE-2019-12325HigJul 22, 2019
    Htek
    UC902
    risk 0.57cvss 8.8epss 0.02

    The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device (DoS) without authentication or execute code (authenticated as a user) to spawn a remote shell as a…

  • CVE-2019-12324HigJul 22, 2019
    The Akuvox Company
    R50P VoIP phone
    risk 0.47cvss 7.2epss 0.04

    A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via…

  • CVE-2019-1010232MedJul 22, 2019
    Juniper Networks
    libslax
    risk 0.42cvss 6.5epss 0.01

    Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by: Buffer Overflow. The impact is: remote dos. The component is: slaxlexer.c:601(funtion:slaxGetInput). The attack vector is: ./slaxproc…

  • CVE-2019-9959MedJul 22, 2019
    Xorg
    Poppler
    risk 0.42cvss 6.5epss 0.02

    The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by…

  • CVE-2019-1010237MedJul 22, 2019
    Ilias
    Ilias
    risk 0.40cvss 6.1epss 0.02

    Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap…

  • CVE-2019-1010235MedJul 22, 2019
    Frog CMS Project
    Frog CMS
    risk 0.35cvss 5.4epss 0.01

    Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.

  • CVE-2019-1010234CriJul 22, 2019
    Linux
    ONOS
    risk 0.64cvss 9.8epss 0.02

    The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The…

  • CVE-2019-4267HigJul 22, 2019
    IBM
    Spectrum Protect
    risk 0.51cvss 7.8epss 0.00

    The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow. This could allow execution of arbitrary code on the local system or the application to crash. IBM X-Force ID: 160200.

  • CVE-2019-4236MedJul 22, 2019
    IBM
    Spectrum Protect
    risk 0.29cvss 4.4epss 0.00

    A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backup or archive if there are more than twelve ACL entries associated with the object in total. As a result, it could allow…

  • CVE-2019-2292HigJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Out of bound access can occur due to buffer copy without checking size of input received from WLAN firmware in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9650, MSM8996AU, QCA6574AU, QCS405,…

  • CVE-2019-2287CriJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.64cvss 9.8epss 0.01

    Improper validation for inputs received from firmware can lead to an out of bound write issue in video driver. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in…

  • CVE-2019-2279CriJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.64cvss 9.8epss 0.01

    Shared memory gets updated with invalid data and may lead to access beyond the allocated memory. in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150,…

  • CVE-2019-2277HigJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Out of bound read can happen due to lack of NULL termination on user controlled data in WLAN in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MSM8996AU, QCS405, QCS605, SD 210/SD 212/SD…

  • CVE-2019-2269CriJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.64cvss 9.8epss 0.01

    Possible buffer overflow while processing the high level lim process action frame due to improper buffer length validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9650,…

  • CVE-2019-2264HigJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Null pointer dereference occurs for channel context while opening glink channel in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9607, MDM9640, MSM8909W, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 439 /…

  • CVE-2019-2261MedJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.36cvss 5.5epss 0.00

    Unauthorized access from GPU subsystem to HLOS or other non secure subsystem memory can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &…

  • CVE-2019-2260HigJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.46cvss 7.0epss 0.00

    A race condition occurs while processing perf-event which can lead to a use after free condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206,…

  • CVE-2019-2243MedJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.36cvss 5.5epss 0.00

    Possible buffer overflow at the end of iterating loop while getting the version info and lead to information disclosure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music,…

  • CVE-2018-2024HigJul 22, 2019
    IBM
    QRadar SIEM
    risk 0.53cvss 8.1epss 0.01

    IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 155350.

  • CVE-2018-13927HigJul 22, 2019
    Qualcomm
    MDM9206
    risk 0.51cvss 7.8epss 0.00

    Debug policy with invalid signature can be loaded when the debug policy functionality is disabled by using the parallel image loading in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,…

  • CVE-2018-13924CriJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.64cvss 9.8epss 0.01

    Lack of check to prevent the buffer length taking negative values can lead to stack overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon…

  • CVE-2018-13896HigJul 22, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    XBL_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL_SEC stage.. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon…

  • CVE-2019-14231CriJul 21, 2019
    Onionbuzz
    Onionbuzz
    risk 0.64cvss 9.8epss 0.05

    An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows…

  • CVE-2019-14230CriJul 21, 2019
    Onionbuzz
    Onionbuzz
    risk 0.64cvss 9.8epss 0.05

    An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an…