PT-2019-17791 · Rapid7 · Insightappsec

Name of the Vulnerable Software and Affected Versions: Rapid7 InsightAppSec versions 2019.06.24 and prior Description: The issue is related to a DLL injection vulnerability in the 'prunsrv.exe' component. A local user who is already authenticated to the operating system can exploit this to elevat...

PT-2019-3026 · Microsoft · Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Microsoft Hyper-V affected versions not specified Description: A denial of service issue exists due to insufficient input validation on the host server. This could allow a remote attacker to cause a denial of service using a specially crafted...

PT-2019-2992 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: An information disclosure issue exists due to the Windows kernel's improper handling of objects in memory. This could allow an attacker to obtain information that could be used to further...

PT-2019-13329 · Floragunn · Search Guard

Name of the Vulnerable Software and Affected Versions: Search Guard versions prior to 24.0 Description: The issue concerns field caps and mapping API leaking field names, but not values, for fields that are not allowed for the user when field level security FLS is activated. This occurs in Search...

PT-2019-3131 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center affected versions not specified Description: The issue is related to insufficient validation of user-supplied input in the web-based management interface, which could allow a remote attacker to conduct a...

PT-2019-3069 · Cisco · Cisco Ios Xr

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software versions prior to Release 6.6.3 Description: A vulnerability in the implementation of the Intermediate System-to-Intermediate System IS-IS routing protocol functionality could allow an unauthenticated attacker who is in...

PT-2019-17686 · Unknown · Min-Http-Server

Name of the Vulnerable Software and Affected Versions: min-http-server all versions Description: A cross-site scripting XSS issue allows an attacker with access to the server file system to execute arbitrary JavaScript code in a victim's browser. The package fails to sanitize filenames, enabling...

PT-2019-13141 · Nats · Nats Server

Name of the Vulnerable Software and Affected Versions: NATS Server versions prior to 2.2.0 Description: The issue is caused by an integer overflow that allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, the attacker must first authenticate. Th...

PT-2019-9616 · Gnuboard · Gnuboard5

Name of the Vulnerable Software and Affected Versions: GNUBOARD5 version 5.3.1.9 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the Extra Contents parameter, also known as the cf 110 parameter in the adm/config form update.php file. This enables attacker...

PT-2019-11539 · Kubernetes · Helm

Name of the Vulnerable Software and Affected Versions: helm versions prior to 2.7.2 Description: The issue concerns improper certificate validation, allowing unauthorized clients to connect to the server because self-signed client certificates were allowed. A malicious client could exploit this b...

PT-2019-13425 · Ping Identity · Ping Identity Agentless Integration Kit

Name of the Vulnerable Software and Affected Versions: Ping Identity Agentless Integration Kit versions prior to 1.5 Description: The issue is related to a Reflected Cross-site Scripting XSS problem. There is no information provided about the estimated number of potentially affected devices...

PT-2019-2695 · Microsoft · Sql Server

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server versions 2014 through 2017 Description: A remote code execution issue exists in Microsoft SQL Server due to incorrect handling of internal functions. This could allow an attacker to execute arbitrary code by sending a...

PT-2019-5777 · FFmpeg +4 · Ffmpeg +4

Name of the Vulnerable Software and Affected Versions: FFmpeg version 4.1.3 Description: The issue is related to a division by zero error in the adx write trailer function of the libavformat library in the FFmpeg multimedia environment. This error can be exploited by a remote attacker to cause a...

PT-2019-6133 · Docker · Docker Desktop Community Edition +1

Name of the Vulnerable Software and Affected Versions: Docker Desktop Community Edition versions prior to 2.1.0.1 Description: The issue is related to incorrect permission assignment for the docker-credential-wincred.exe file in the %PROGRAMDATA%DockerDesktopversion-bin folder. This could allow a...

PT-2019-18220 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 14.0.0 through 14.0.0.4 F5 BIG-IP versions 14.1.0 through 14.1.0.5 Description: The issue arises from malformed HTTP requests made to an undisclosed iControl REST endpoint, which can cause an infinite loop of the restjavad...

PT-2019-17047 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.0.0.1 Description: The issue reveals sensitive information from a stack trace, which could be used in further attacks against the system. Recommendations: For versions 6.0.0.0 and 6.0.0.1...

PT-2019-13029 · Qemu +2 · Qemu +2

Name of the Vulnerable Software and Affected Versions: QEMU versions 4.0.0 and earlier Description: The QMP guest exec command in QEMU is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP comma...

PT-2019-13028 · Qemu +2 · Qemu +2

Name of the Vulnerable Software and Affected Versions: QEMU versions 4.0.0 and earlier Description: The QMP migrate command in QEMU is vulnerable to OS command injection, allowing a remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP...

PT-2019-4485 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel version 5.0.21 Description: The issue is related to a use-after-free in the ext4 put super function in fs/ext4/super.c, which is connected to the dump orphan list function in the same file. This can occur when mounting a crafted...

PT-2019-6223 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel version 5.0.21 Description: The issue is related to a use-after-free vulnerability in the btrfs queue work function, located in the fs/btrfs/async-thread.c file. This vulnerability can be exploited by mounting a crafted btrfs...