| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-3956 | Cri | 0.64 | 9.8 | 0.01 | Mar 25, 2019 | Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices… | ||
| CVE-2019-6240 | Hig | 0.49 | 7.5 | 0.02 | Mar 25, 2019 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal. | ||
| CVE-2019-3484 | Hig | 0.51 | 7.8 | 0.01 | Mar 25, 2019 | Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7. | ||
| CVE-2019-3483 | Med | 0.42 | 6.5 | 0.02 | Mar 25, 2019 | Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7. | ||
| CVE-2019-3482 | Med | 0.43 | 6.5 | 0.04 | Mar 25, 2019 | Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7. | ||
| CVE-2019-3481 | Hig | 0.46 | 7.1 | 0.02 | Mar 25, 2019 | Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7. | ||
| CVE-2019-3480 | Med | 0.40 | 6.1 | 0.01 | Mar 25, 2019 | Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7. | ||
| CVE-2019-3479 | Cri | 0.64 | 9.8 | 0.07 | Mar 25, 2019 | Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7. | ||
| CVE-2019-3476 | Cri | 0.64 | 9.8 | 0.03 | Mar 25, 2019 | Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution. | ||
| CVE-2015-3954 | Cri | 0.64 | 9.8 | 0.02 | Mar 25, 2019 | Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the… | ||
| CVE-2015-3953 | Cri | 0.64 | 9.8 | 0.02 | Mar 25, 2019 | Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the… | ||
| CVE-2017-9376 | Med | 0.43 | 6.5 | 0.07 | Mar 25, 2019 | ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do. | ||
| CVE-2017-9362 | Hig | 0.58 | 8.8 | 0.04 | Mar 25, 2019 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. | ||
| CVE-2015-3952 | Hig | 0.49 | 7.5 | 0.01 | Mar 25, 2019 | Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the… | ||
| CVE-2019-10016 | Med | 0.40 | 6.1 | 0.01 | Mar 25, 2019 | GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring. | ||
| CVE-2019-10027 | Med | 0.31 | 4.8 | 0.01 | Mar 25, 2019 | PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen. | ||
| CVE-2019-10026 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for the psOpRoll case. | ||
| CVE-2019-10025 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits. | ||
| CVE-2019-10024 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters. | ||
| CVE-2019-10023 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpMod case. | ||
| CVE-2019-10022 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.cc. | ||
| CVE-2019-10021 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps. | ||
| CVE-2019-10020 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bresenham parameters. | ||
| CVE-2019-10019 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc for nStripes. | ||
| CVE-2019-10018 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2019 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case. | ||
| CVE-2019-10017 | Med | 0.35 | 5.4 | 0.01 | Mar 24, 2019 | CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker. | ||
| CVE-2019-10015 | Hig | 0.47 | 7.2 | 0.02 | Mar 24, 2019 | baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file. | ||
| CVE-2019-10014 | Med | 0.42 | 6.5 | 0.01 | Mar 24, 2019 | In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated. | ||
| CVE-2019-10010 | Med | 0.33 | 6.1 | 0.01 | Mar 24, 2019 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than… | ||
| CVE-2019-9978 | Med | 0.60 | 6.1 | 0.73 | KEV | Mar 24, 2019 | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro. | |
| CVE-2019-9977 | Hig | 0.57 | 8.8 | 0.03 | Mar 24, 2019 | The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code execution, and display a crafted message to vehicle occupants. | ||
| CVE-2019-9970 | Med | 0.42 | 6.5 | 0.02 | Mar 24, 2019 | Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even… | ||
| CVE-2019-9969 | Hig | 0.51 | 7.8 | 0.02 | Mar 24, 2019 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to xnview+0x385399. | ||
| CVE-2019-9968 | Hig | 0.51 | 7.8 | 0.01 | Mar 24, 2019 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlQueueWorkItem. | ||
| CVE-2019-9967 | Hig | 0.51 | 7.8 | 0.01 | Mar 24, 2019 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlPrefixUnicodeString. | ||
| CVE-2019-9966 | Hig | 0.51 | 7.8 | 0.01 | Mar 24, 2019 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to xnview+0x38536c. | ||
| CVE-2019-9965 | Hig | 0.51 | 7.8 | 0.01 | Mar 24, 2019 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlReAllocateHeap. | ||
| CVE-2019-9964 | Hig | 0.51 | 7.8 | 0.01 | Mar 24, 2019 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey. | ||
| CVE-2019-9963 | Hig | 0.51 | 7.8 | 0.01 | Mar 24, 2019 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlFreeHeap. | ||
| CVE-2019-9962 | Hig | 0.51 | 7.8 | 0.01 | Mar 24, 2019 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to VCRUNTIME140!memcpy. | ||
| CVE-2019-9960 | Cri | 0.68 | 9.8 | 0.13 | Mar 24, 2019 | The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path. | ||
| CVE-2019-9956 | Hig | 0.58 | 8.8 | 0.06 | Mar 24, 2019 | In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file. | ||
| CVE-2015-3965 | Hig | 0.57 | 8.8 | 0.03 | Mar 23, 2019 | Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function. | ||
| CVE-2016-10743 | Hig | 0.49 | 7.5 | 0.02 | Mar 23, 2019 | hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call. | ||
| CVE-2019-9948 | Cri | 0.60 | 9.1 | 0.12 | Mar 23, 2019 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call. | ||
| CVE-2019-9947 | Med | 0.33 | 6.1 | 0.05 | Mar 23, 2019 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path… | ||
| CVE-2019-9945 | Cri | 0.64 | 9.8 | 0.06 | Mar 23, 2019 | SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web… | ||
| CVE-2019-9942 | Low | 0.17 | 3.7 | 0.01 | Mar 23, 2019 | A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place. | ||
| CVE-2019-9649 | Med | 0.39 | 5.3 | 0.15 | Mar 22, 2019 | An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and… | ||
| CVE-2019-1766 | Hig | 0.49 | 7.5 | 0.02 | Mar 22, 2019 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability… |
- risk 0.64cvss 9.8epss 0.01
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices…
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.
- risk 0.51cvss 7.8epss 0.01
Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.
- risk 0.42cvss 6.5epss 0.02
Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.
- risk 0.43cvss 6.5epss 0.04
Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.
- risk 0.46cvss 7.1epss 0.02
Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.
- risk 0.40cvss 6.1epss 0.01
Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
- risk 0.64cvss 9.8epss 0.07
Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.
- risk 0.64cvss 9.8epss 0.03
Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution.
- risk 0.64cvss 9.8epss 0.02
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the…
- risk 0.64cvss 9.8epss 0.02
Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the…
- risk 0.43cvss 6.5epss 0.07
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do.
- risk 0.58cvss 8.8epss 0.04
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.
- risk 0.49cvss 7.5epss 0.01
Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the…
- risk 0.40cvss 6.1epss 0.01
GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.
- risk 0.31cvss 4.8epss 0.01
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for the psOpRoll case.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpMod case.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.cc.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bresenham parameters.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc for nStripes.
- risk 0.36cvss 5.5epss 0.01
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case.
- risk 0.35cvss 5.4epss 0.01
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
- risk 0.47cvss 7.2epss 0.02
baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.
- risk 0.42cvss 6.5epss 0.01
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than…
- risk 0.60cvss 6.1epss 0.73
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
- risk 0.57cvss 8.8epss 0.03
The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code execution, and display a crafted message to vehicle occupants.
- risk 0.42cvss 6.5epss 0.02
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even…
- risk 0.51cvss 7.8epss 0.02
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to xnview+0x385399.
- risk 0.51cvss 7.8epss 0.01
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlQueueWorkItem.
- risk 0.51cvss 7.8epss 0.01
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlPrefixUnicodeString.
- risk 0.51cvss 7.8epss 0.01
XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to xnview+0x38536c.
- risk 0.51cvss 7.8epss 0.01
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlReAllocateHeap.
- risk 0.51cvss 7.8epss 0.01
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey.
- risk 0.51cvss 7.8epss 0.01
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlFreeHeap.
- risk 0.51cvss 7.8epss 0.01
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to VCRUNTIME140!memcpy.
- risk 0.68cvss 9.8epss 0.13
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
- risk 0.58cvss 8.8epss 0.06
In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
- risk 0.57cvss 8.8epss 0.03
Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.
- risk 0.49cvss 7.5epss 0.02
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
- risk 0.60cvss 9.1epss 0.12
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
- risk 0.33cvss 6.1epss 0.05
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path…
- risk 0.64cvss 9.8epss 0.06
SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web…
- risk 0.17cvss 3.7epss 0.01
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
- risk 0.39cvss 5.3epss 0.15
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and…
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability…