PUBLIÉES EN
octobre 2019
631 CVE, des plus récentes aux plus anciennes.
CVE-2019-18229Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities …
6.5 MOYENNE
CVE-2019-16907An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication…
5.3 MOYENNE
CVE-2019-5023An exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9.24-test7, grsecurity official from vers…
5.9 MOYENNE
CVE-2019-16295Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exploited by a local attacker who supplies …
4.6 MOYENNE
CVE-2012-6124A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for sec…
5.3 MOYENNE
CVE-2012-6123Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."
6.5 MOYENNE
CVE-2019-5095An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0. Authenticated users can obtain the summary for issues they do not have …
4.3 MOYENNE
CVE-2013-1951A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function n…
6.1 MOYENNE
CVE-2013-1934A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject a…
5.4 MOYENNE
CVE-2013-1932A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web scr…
5.4 MOYENNE
CVE-2013-1931A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version.
6.1 MOYENNE
CVE-2013-1930MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.
4.3 MOYENNE
CVE-2019-18657ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.
5.3 MOYENNE
CVE-2019-14356On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated…
5.3 MOYENNE
CVE-2019-18656Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements.
6.1 MOYENNE
CVE-2019-16251plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
4.3 MOYENNE
CVE-2019-3419A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker could exploit this vulnerability to build a link to the device …
5.7 MOYENNE
CVE-2019-18369In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
5.3 MOYENNE
CVE-2019-18367In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
5.3 MOYENNE
CVE-2019-18366In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.
5.3 MOYENNE
CVE-2019-18365In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
4.3 MOYENNE
CVE-2010-2490Mumble: murmur-server has DoS due to malformed client query
6.5 MOYENNE
CVE-2019-18363In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.
5.3 MOYENNE
CVE-2019-18362JetBrains MPS before 2019.2.2 exposed listening ports to the network.
5.3 MOYENNE
CVE-2019-18361JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.
5.3 MOYENNE
CVE-2019-18360In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.
5.3 MOYENNE
CVE-2018-21030Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
5.3 MOYENNE
CVE-2019-18424An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This o…
6.8 MOYENNE
CVE-2019-18420An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a va…
6.5 MOYENNE
CVE-2019-17551In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a st…
6.1 MOYENNE
CVE-2019-18645The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be written to privileged directories.
5.5 MOYENNE
CVE-2019-18644The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted.
5.9 MOYENNE
CVE-2010-1673A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.
6.1 MOYENNE
CVE-2010-0749Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.
5.3 MOYENNE
CVE-2019-12417A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disc…
4.8 MOYENNE
CVE-2010-0398The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
6.5 MOYENNE
CVE-2019-17326ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction …
6.5 MOYENNE
CVE-2019-17325ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of…
6.5 MOYENNE
CVE-2019-17324ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file,…
6.5 MOYENNE
CVE-2019-17322ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable fi…
6.5 MOYENNE
CVE-2019-17321ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated with session, could leak username via session file path of …
5.3 MOYENNE
CVE-2010-0207In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers.
5.5 MOYENNE
CVE-2010-0206xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream objects.
5.5 MOYENNE
CVE-2019-18207In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Compon…
5.4 MOYENNE
CVE-2019-18205Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user inpu…
6.1 MOYENNE
CVE-2018-18678GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_upd…
6.1 MOYENNE
CVE-2019-7619Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted r…
5.3 MOYENNE
CVE-2019-8235An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be ab…
6.5 MOYENNE
CVE-2019-9758An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/…
5.4 MOYENNE
CVE-2019-6847A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could ca…
4.9 MOYENNE