2710 matches found
CVE-2019-14278
Technical details about CVE-2019-14278 are not publicly available in the provided connected documents; no additional specifics on affected components, exploit methods, or remediation are included here. Monitor for updates.
Bold Page Builder < 2.3.2 - Missing Access Controls
The vulnerability allows any unauthenticated user to perform actions that only an administrator should be allowed to do e.g., modifying settings and importing data...
Memory Corruption in PAN-OS
Palo Alto Networks is aware of a memory corruption vulnerability in PAN-OS Ref: PAN-123603/CVE-2019-1580. Successful exploitation will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon SSHD and corrupt arbitrary memory. This issue affects PAN-OS 7.1.24 and earlier,...
CVE-2019-6159
A stored cross-site scripting XSS vulnerability exists in various firmware versions of the legacy IBM System x IMM IMM v1 embedded Baseboard Management Controller BMC. This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be...
Cross site scripting
A stored cross-site scripting XSS vulnerability exists in various firmware versions of the legacy IBM System x IMM IMM v1 embedded Baseboard Management Controller BMC. This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be...
CVE-2019-6159
A stored cross-site scripting XSS vulnerability exists in various firmware versions of the legacy IBM System x IMM IMM v1 embedded Baseboard Management Controller BMC. This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be...
Debian DLA-1879-1 : jackson-databind security update
Deserialization flaws were discovered in jackson-databind relating to EHCache and logback/jndi, which could allow an unauthenticated user to perform remote code execution. The issue was resolved by extending the blacklist and blocking more classes from polymorphic deserialization. For Debian 8...
edk2: stack overflow in XHCI causing denial of service
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access...
CVE-2019-7950
An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially...
CVE-2019-7855
A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation...
Improper access control
An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially...
Design/Logic Flaw
A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation...
CVE-2019-7950
CVE-2019-7950 affects Magento 2.x before specific patch levels: 2.1 < 2.1.18, 2.2 < 2.2.9, and 2.3
CVE-2019-7855
CVE-2019-7855 affects Magento platforms: Magento 2.1 before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2. Description: a cryptographic flaw could be exploited by an unauthenticated user to discover an invariant used in gift card generation. This is a cryptographic weakness rathe...
CVE-2019-7855
A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation...
Authentication flaw
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through findresource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, i...
CVE-2019-10198
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through findresource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, i...
SQL Injection in lookup-server (NC-SA-2019-010)
Improper sanitation of user input allowed any unauthenticated user to perform SQL injection attacks...
Sql injection
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the setcount ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged use...
CVE-2019-14230
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the setcount ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged use...