| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-0111 | Med | 0.36 | 5.5 | 0.00 | Feb 18, 2019 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access. | ||
| CVE-2019-0110 | Med | 0.36 | 5.5 | 0.00 | Feb 18, 2019 | Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access. | ||
| CVE-2019-0109 | Hig | 0.51 | 7.8 | 0.00 | Feb 18, 2019 | Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access. | ||
| CVE-2019-0108 | Med | 0.36 | 5.5 | 0.00 | Feb 18, 2019 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of information via local access. | ||
| CVE-2019-0107 | Med | 0.44 | 6.7 | 0.00 | Feb 18, 2019 | Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access. | ||
| CVE-2019-0106 | Med | 0.44 | 6.7 | 0.00 | Feb 18, 2019 | Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access. | ||
| CVE-2019-0105 | Hig | 0.51 | 7.8 | 0.00 | Feb 18, 2019 | Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially enable escalation of privilege via local access. | ||
| CVE-2019-0104 | Med | 0.36 | 5.5 | 0.00 | Feb 18, 2019 | Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access. | ||
| CVE-2019-0103 | Med | 0.36 | 5.5 | 0.00 | Feb 18, 2019 | Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access. | ||
| CVE-2019-0102 | Hig | 0.57 | 8.8 | 0.01 | Feb 18, 2019 | Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access. | ||
| CVE-2019-0101 | Cri | 0.64 | 9.8 | 0.02 | Feb 18, 2019 | Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escalation of privilege to the Intel Unite(R) Solution administrative portal via network access. | ||
| CVE-2018-3700 | Med | 0.44 | 6.7 | 0.01 | Feb 18, 2019 | Code injection vulnerability in the installer for Intel(R) USB 3.0 eXtensible Host Controller Driver for Microsoft Windows 7 before version 5.0.4.43v2 may allow a user to potentially enable escalation of privilege via local access. | ||
| CVE-2018-12159 | Med | 0.36 | 5.5 | 0.00 | Feb 18, 2019 | Buffer overflow in the command-line interface for Intel(R) PROSet Wireless v20.50 and before may allow an authenticated user to potentially enable denial of service via local access. | ||
| CVE-2019-8903 | Hig | 0.51 | 7.5 | 0.72 | Feb 18, 2019 | index.js in Total.js Platform before 3.2.3 allows path traversal. | ||
| CVE-2019-8372 | Hig | 0.46 | 7.0 | 0.01 | Feb 18, 2019 | The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitrary physical memory via specially crafted IOCTL requests and elevate system privileges. This occurs because the device object has an… | ||
| CVE-2019-6453 | Hig | 0.60 | 8.1 | 0.55 | Feb 18, 2019 | mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is… | ||
| CVE-2019-8902 | Med | 0.37 | 5.7 | 0.00 | Feb 18, 2019 | An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI. | ||
| CVE-2019-8436 | Med | 0.35 | 5.4 | 0.01 | Feb 18, 2019 | imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter. | ||
| CVE-2019-8435 | Med | 0.31 | 4.8 | 0.01 | Feb 18, 2019 | admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header. | ||
| CVE-2019-8434 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2019 | In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. | ||
| CVE-2019-8433 | Hig | 0.49 | 7.5 | 0.01 | Feb 18, 2019 | JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demonstrated by a .php file. | ||
| CVE-2019-8432 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2019 | In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter. | ||
| CVE-2019-8429 | Cri | 0.57 | 9.8 | 0.02 | Feb 18, 2019 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter. | ||
| CVE-2019-8428 | Cri | 0.57 | 9.8 | 0.02 | Feb 18, 2019 | ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value. | ||
| CVE-2019-8427 | Cri | 0.64 | 9.8 | 0.03 | Feb 18, 2019 | daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. | ||
| CVE-2019-8426 | Med | 0.33 | 6.1 | 0.01 | Feb 18, 2019 | skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter. | ||
| CVE-2019-8425 | Med | 0.33 | 6.1 | 0.01 | Feb 18, 2019 | includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. | ||
| CVE-2019-8424 | Cri | 0.57 | 9.8 | 0.02 | Feb 18, 2019 | ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter. | ||
| CVE-2019-8423 | Cri | 0.64 | 9.8 | 0.02 | Feb 18, 2019 | ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter. | ||
| CVE-2019-8422 | Hig | 0.47 | 7.2 | 0.01 | Feb 17, 2019 | A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php. | ||
| CVE-2019-8421 | Hig | 0.47 | 7.2 | 0.01 | Feb 17, 2019 | upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter. | ||
| CVE-2019-8419 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2019 | VNote 2.2 has XSS via a new text note. | ||
| CVE-2019-8418 | Hig | 0.57 | 8.8 | 0.01 | Feb 17, 2019 | SeaCMS 7.2 mishandles member.php?mod=repsw4 requests. | ||
| CVE-2019-7649 | Hig | 0.49 | 7.5 | 0.01 | Feb 17, 2019 | global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing. | ||
| CVE-2019-8413 | Med | 0.36 | 5.5 | 0.00 | Feb 17, 2019 | On Xiaomi MIX 2 devices with the 4.4.78 kernel, a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/elliptic0 causes a system crash via IOCTL 0x4008c575 (aka decimal 1074316661). | ||
| CVE-2019-8412 | Hig | 0.57 | 8.8 | 0.03 | Feb 17, 2019 | FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.php?s=Admin-Data-Del-id-..\ directory traversal. | ||
| CVE-2019-8411 | Hig | 0.49 | 7.5 | 0.03 | Feb 17, 2019 | admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal. | ||
| CVE-2019-8408 | Med | 0.32 | 4.9 | 0.01 | Feb 17, 2019 | OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice. | ||
| CVE-2019-8407 | Med | 0.42 | 6.5 | 0.01 | Feb 17, 2019 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. | ||
| CVE-2018-20782 | Hig | 0.53 | 7.5 | 0.10 | Feb 17, 2019 | The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages. | ||
| CVE-2016-10742 | Med | 0.40 | 6.1 | 0.03 | Feb 17, 2019 | Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter. | ||
| CVE-2019-8393 | Cri | 0.64 | 9.8 | 0.01 | Feb 17, 2019 | Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled. | ||
| CVE-2019-8400 | Med | 0.33 | 6.1 | 0.01 | Feb 17, 2019 | ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. | ||
| CVE-2019-8398 | Med | 0.42 | 6.5 | 0.01 | Feb 17, 2019 | An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c. | ||
| CVE-2019-8397 | Med | 0.42 | 6.5 | 0.01 | Feb 17, 2019 | An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c. | ||
| CVE-2019-8396 | Med | 0.42 | 6.5 | 0.01 | Feb 17, 2019 | A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2." | ||
| CVE-2019-8395 | Cri | 0.64 | 9.8 | 0.07 | Feb 17, 2019 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request. | ||
| CVE-2019-8394 | Med | 0.62 | 6.5 | 0.63 | KEV | Feb 17, 2019 | Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. | |
| CVE-2019-8392 | Hig | 0.49 | 7.5 | 0.02 | Feb 17, 2019 | An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via the SetWLanRadioSettings HNAP API to the web service provided by /bin/goahead. | ||
| CVE-2019-7399 | Hig | 0.48 | 7.4 | 0.01 | Feb 17, 2019 | Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages. |
- risk 0.36cvss 5.5epss 0.00
Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
- risk 0.36cvss 5.5epss 0.00
Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
- risk 0.51cvss 7.8epss 0.00
Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- risk 0.36cvss 5.5epss 0.00
Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of information via local access.
- risk 0.44cvss 6.7epss 0.00
Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.
- risk 0.44cvss 6.7epss 0.00
Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.
- risk 0.51cvss 7.8epss 0.00
Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially enable escalation of privilege via local access.
- risk 0.36cvss 5.5epss 0.00
Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
- risk 0.36cvss 5.5epss 0.00
Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
- risk 0.57cvss 8.8epss 0.01
Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
- risk 0.64cvss 9.8epss 0.02
Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escalation of privilege to the Intel Unite(R) Solution administrative portal via network access.
- risk 0.44cvss 6.7epss 0.01
Code injection vulnerability in the installer for Intel(R) USB 3.0 eXtensible Host Controller Driver for Microsoft Windows 7 before version 5.0.4.43v2 may allow a user to potentially enable escalation of privilege via local access.
- risk 0.36cvss 5.5epss 0.00
Buffer overflow in the command-line interface for Intel(R) PROSet Wireless v20.50 and before may allow an authenticated user to potentially enable denial of service via local access.
- risk 0.51cvss 7.5epss 0.72
index.js in Total.js Platform before 3.2.3 allows path traversal.
- risk 0.46cvss 7.0epss 0.01
The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitrary physical memory via specially crafted IOCTL requests and elevate system privileges. This occurs because the device object has an…
- risk 0.60cvss 8.1epss 0.55
mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is…
- risk 0.37cvss 5.7epss 0.00
An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI.
- risk 0.35cvss 5.4epss 0.01
imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter.
- risk 0.31cvss 4.8epss 0.01
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.
- risk 0.40cvss 6.1epss 0.01
In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.
- risk 0.49cvss 7.5epss 0.01
JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demonstrated by a .php file.
- risk 0.40cvss 6.1epss 0.01
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.
- risk 0.57cvss 9.8epss 0.02
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.
- risk 0.57cvss 9.8epss 0.02
ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value.
- risk 0.64cvss 9.8epss 0.03
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.
- risk 0.33cvss 6.1epss 0.01
skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter.
- risk 0.33cvss 6.1epss 0.01
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.
- risk 0.57cvss 9.8epss 0.02
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter.
- risk 0.64cvss 9.8epss 0.02
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
- risk 0.47cvss 7.2epss 0.01
A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php.
- risk 0.47cvss 7.2epss 0.01
upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter.
- risk 0.40cvss 6.1epss 0.01
VNote 2.2 has XSS via a new text note.
- risk 0.57cvss 8.8epss 0.01
SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.
- risk 0.49cvss 7.5epss 0.01
global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing.
- risk 0.36cvss 5.5epss 0.00
On Xiaomi MIX 2 devices with the 4.4.78 kernel, a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/elliptic0 causes a system crash via IOCTL 0x4008c575 (aka decimal 1074316661).
- risk 0.57cvss 8.8epss 0.03
FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.php?s=Admin-Data-Del-id-..\ directory traversal.
- risk 0.49cvss 7.5epss 0.03
admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.
- risk 0.32cvss 4.9epss 0.01
OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice.
- risk 0.42cvss 6.5epss 0.01
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.
- risk 0.53cvss 7.5epss 0.10
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
- risk 0.40cvss 6.1epss 0.03
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.
- risk 0.64cvss 9.8epss 0.01
Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled.
- risk 0.33cvss 6.1epss 0.01
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c.
- risk 0.42cvss 6.5epss 0.01
A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."
- risk 0.64cvss 9.8epss 0.07
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
- risk 0.62cvss 6.5epss 0.63
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via the SetWLanRadioSettings HNAP API to the web service provided by /bin/goahead.
- risk 0.48cvss 7.4epss 0.01
Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.