PT-2019-8473 · WordPress · Weblibrarian

Name of the Vulnerable Software and Affected Versions: weblibrarian plugin versions prior to 3.4.8.6 for WordPress Description: The issue concerns a Cross-Site Scripting XSS vulnerability. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website,...

PT-2019-4468 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.2.10 Description: The issue is related to a use-after-free bug in the Linux kernel, specifically in the drivers/usb/class/cdc-acm.c driver. This bug can be triggered by a malicious USB device, potentially...

PT-2019-9043 · Yandex · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 18.12.13 Description: The issue allows path traversal and reading of arbitrary files through error messages in functions for loading CatBoost models. Recommendations: For versions prior to 18.12.13, update to...

PT-2019-9040 · Clickhouse · Clickhouse Mysql Client

Name of the Vulnerable Software and Affected Versions: ClickHouse MySQL client versions prior to 1.1.54390 Description: The issue concerns the "LOAD DATA LOCAL INFILE" functionality in the ClickHouse MySQL client, which was enabled and allowed a malicious MySQL database to read arbitrary files fr...

PT-2019-7674 · WordPress · Wp-Google-Map-Plugin

Name of the Vulnerable Software and Affected Versions: wp-google-map-plugin versions prior to 3.1.2 Description: The issue is related to a Cross-Site Scripting XSS problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially...

PT-2019-13377 · Rockwell Automation · Arena Simulation

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier Description: The issue allows for limited exposure of information related to the targeted workstation when a maliciously crafted Arena file is opened by an unsuspecti...

PT-2019-13694 · Openstack +1 · Openstack Nova +1

Name of the Vulnerable Software and Affected Versions: OpenStack Nova versions prior to 17.0.12 OpenStack Nova versions 18.x prior to 18.2.2 OpenStack Nova versions 19.x prior to 19.0.2 Description: An issue in OpenStack Nova may leak details of the underlying environment in the response to an AP...

PT-2019-4479 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.2.9 Description: The issue is related to a use-after-free bug in the Linux kernel, specifically in the drivers/usb/misc/yurex.c driver. This bug can be triggered by a malicious USB device, potentially allowing...

PT-2019-2899 · Icedtea +4 · Icedtea-Web +4

Name of the Vulnerable Software and Affected Versions: icedtea-web versions 1.7.2 and earlier icedtea-web versions 1.8.2 and earlier Description: The issue is related to a zip-slip attack during auto-extraction of a JAR file, which could allow an attacker to write files to arbitrary locations. Th...

PT-2019-5668 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: DaveGamble/cJSON versions 1.7.8 Description: The issue is related to an improper check for unusual or exceptional conditions, which can lead to a null dereference. This can cause a denial of service when a crafted JSON file is used as an atta...

PT-2019-6418 · Red Hat +5 · Resteasy +6

Name of the Vulnerable Software and Affected Versions: resteasy versions 3.x.x prior to 3.12.0.Final resteasy versions 4.x.x prior to 4.6.0.Final Description: A flaw was found in resteasy where an improper input validation results in returning an illegal header that integrates into the server's...

Prototype Pollution

Overview Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects. Recommendation Update to...

PT-2019-4588 · Sap · Sap Basis

Name of the Vulnerable Software and Affected Versions: SAP Basis versions 7.31, 7.4, 7.5 Description: The issue arises from insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This can be exploited by a remote attacker to perform cross-site...

PT-2019-17918 · Unknown · Custom Css Pro

Name of the Vulnerable Software and Affected Versions: Custom CSS Pro versions 1.0.3 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. The attack vectors are not specified. Recommendations: For Custom CSS Pro versio...

PT-2019-18510 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The issue is related to the session-ID being of an insufficient length, making it vulnerable to brute force exploitation. This could allow a remote attacker to obtain a valid sessio...

PT-2019-13131 · Matio +1 · Matio +1

Name of the Vulnerable Software and Affected Versions: MATIO versions prior to 1.5.16 Description: Multiple integer overflows exist in the software, related to files such as mat.c, mat4.c, mat5.c, mat73.c, and matvar struct.c. Recommendations: For versions prior to 1.5.16, update to version 1.5.1...

PT-2019-13095 · Toaruos · Toaruos

Name of the Vulnerable Software and Affected Versions: ToaruOS versions prior to 1.10.10 Description: The issue allows for a denial of service when a critical error occurs in certain sys sbrk allocation patterns, specifically those involving PAGE SIZE and a value less than PAGE SIZE...

Denial of Service in ws

Affected versions of ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names is sent. Proof of concept const WebSocket = require'ws'; const net = require'net'; const wss = new WebSocket.Server port: 3000 ,...

GHSA-WRW9-M778-G6MC Memory Exposure in bl

Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure. bl.appendnumber in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory Recommendation Update to version 0.9.5, 1.0.1 or later...

Memory Exposure in bl

Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure. bl.appendnumber in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory Recommendation Update to version 0.9.5, 1.0.1 or later...