PT-2019-9513 · Ibm · Ibm Rational Collaborative Lifecycle Management

Name of the Vulnerable Software and Affected Versions: IBM Rational Collaborative Lifecycle Management versions 6.0 through 6.0.6.1 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

PT-2019-9455 · Ibm · Ibm Rational Collaborative Lifecycle Management

Name of the Vulnerable Software and Affected Versions: IBM Rational Collaborative Lifecycle Management versions 6.0 through 6.0.6.1 Description: The issue discloses sensitive information in error messages, which may be used by a malicious user to orchestrate further attacks. Recommendations: For...

PT-2019-13064 · Imagemagick +4 · Imagemagick +4

Name of the Vulnerable Software and Affected Versions: ImageMagick version 7.0.8-34 Description: The issue is related to a memory leak in the ReadPCLImage function, located in coders/pcl.c. Recommendations: For ImageMagick version 7.0.8-34, consider updating to a newer version that addresses the...

PT-2019-16626 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.19 Description: The issue is related to a problem in the resetpassword function, which has XSS. Recommendations: For MyBB version 1.8.19, update to a newer version that contains a fix for this issue...

GHSA-XC7V-WXCW-J472 Memory Exposure in tunnel-agent

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number. Proof-of-concept: js require'request' method: 'GET', uri: 'http://www.example.com', tunnel: true, proxy: protocol: 'http:',...

PT-2019-12676 · Atutor · Atutor

Name of the Vulnerable Software and Affected Versions: ATutor versions prior to 2.2.5 Description: The issue allows for arbitrary file uploads via the "mods/ core/backups/upload.php" component, potentially resulting in remote command execution. An attacker can use an instructor account to fully...

PT-2019-2205 · Intel · Intel Active Management Technology

Name of the Vulnerable Software and Affected Versions: Intel Active Management Technology versions prior to 11.8.65 Intel Active Management Technology versions prior to 11.11.65 Intel Active Management Technology versions prior to 11.22.65 Intel Active Management Technology versions prior to...

PT-2019-12518 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: cJSON versions prior to 1.7.11 Description: The issue allows out-of-bounds access, related to multiline comments. Recommendations: For versions prior to 1.7.11, update to version 1.7.11 or later to resolve the issue...

PT-2019-9130 · Gnu · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.1.6 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML in specific files, namely adm/boardgroup form...

PT-2019-5442 · Adobe +1 · Flash Player +1

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 32.0.0.156 and earlier Description: The issue is related to a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution, allowing a remote attacker to bypass security restrictions...

PT-2019-17847 · Overit · Overit Geocall

Name of the Vulnerable Software and Affected Versions: OverIT Geocall versions prior to 6.3 build 2:346977 Description: A directory traversal issue was discovered in the log-management component. Recommendations: For OverIT Geocall versions prior to 6.3 build 2:346977, update to a version that...

KinagaCMS vulnerable to cross-site scripting

Overview KinagaCMS is an opensource Contents Management System CMS. KinagaCMS uses the old version of Bootstrap thus inherits multiple cross-site scripting vulnerabilities CWE-79: CVE-2018-14040, CVE-2018-14041, CVE-2019-8331 existed in Bootstrap. Project Kinaga reported this vulnerability to IPA...

Denial of Service in mqtt-packet

Versions of mqtt-packet prior to 3.4.6, or 4.x prior to 4.0.5 are affected by a denial of service vulnerability wherein specific sequences of MQTT packets can crash the application. Recommendation Version 3.x: Update to version 3.4.6 or later. Version 4.x: Update to version 4.0.5 or later...

PT-2019-19010 · Hdf +3 · Hdf5 +3

Name of the Vulnerable Software and Affected Versions: HDF5 versions prior to 1.10.5 Description: A buffer overflow issue in the HDF5 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file. Recommendations: For versions...

GHSA-H466-J336-74WX Prototype Pollution in mpath

Versions of mpath before 0.5.1 are vulnerable to prototype pollution. Provided certain input mpath can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation Update to version 0.5.1 or later...

Command Injection in apex-publish-static-files

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method. Recommendation Update to version 2.0.1 or later...

PT-2018-13438 · Wago · Wago 750-88X +1

Name of the Vulnerable Software and Affected Versions: WAGO 750-88X and WAGO 750-89X Ethernet Controller devices versions 01.09.1813 and before Description: The issue concerns a cross-site scripting XSS flaw in the SNMP configuration of the affected devices. This flaw can be exploited via the...

PT-2018-9383 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: cJSON versions 1.7.6 and earlier Description: The issue in the cJSON library can result in Denial of Service DoS and potentially force a memory leak if the system is in low memory and the attacker can force the data to be printed...

PT-2018-3392 · None +4 · Zziplib +4

Name of the Vulnerable Software and Affected Versions: ZZIPlib versions prior to 0.13.70 Description: The issue is related to a memory leak in the zzip parse root directory function, which can lead to a denial of service attack. This is caused by a resource not being released after its valid...

GHSA-3V6H-HQM4-2RG6 Arbitrary File Write in adm-zip

Versions of adm-zip before 0.4.9 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames ../../file.txt for example. Recommendation Update to version 0.4.9 or later...