CVE-2019-15641: Improper Restriction of XML External Entity Reference

xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...

CVE-2019-12623

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different...

CVE-2019-3967: Improper Limitation of a Pathname to a Restricted Directory

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

CVE-2019-3968: Improper Neutralization of Special Elements used in an OS Command

In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form...

CVE-2019-1218: Improper Neutralization of Input During Web Page Generation

A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability coul...

CVE-2019-1203: Improper Neutralization of Input During Web Page Generation

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

CVE-2019-10927: Improper Check or Handling of Exceptional Conditions

A vulnerability has been identified in SCALANCE SC-600 V2.0, SCALANCE XB-200 V4.1, SCALANCE XC-200 V4.1, SCALANCE XF-200BA V4.1, SCALANCE XP-200 V4.1, SCALANCE XR-300WG V4.1. An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service...

CVE-2019-3800: Insufficiently Protected Credentials

CF CLI version prior to v6.45.0 bosh release version 1.16.0 writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the...

CVE-2019-3960: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote, authenticated attacker to execute arbitrary code by uploading a malicious PHP file...

CVE-2019-14362

Openbravo ERP prior to 3.0PR19Q1.3 is affected by a Directory Traversal vulnerability. The issue allows remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value. Affected component is Openbravo ERP (web application) with directory ...

CVE-2019-2799

Vulnerability in the Oracle ODBC Driver component of Oracle Database Server PRIVILEGE CANNOT BE NONE FOR AUTHENTICATED ATTACKS. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Difficult to exploit vulnerability allows low privileged attacker having None privilege wi...

CVE-2019-13150: Improper Neutralization of Special Elements used in a Command

An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi exploitable with authentication. The command injection exists in the key ipaddr...

CVE-2019-7669: Unrestricted Upload of File with Dangerous Type

Prima Systems FlexAir, Versions 2.3.38 and prior. Improper validation of file extensions when uploading files could allow a remote authenticated attacker to upload and execute malicious applications within the application’s web root with root privileges...

CVE-2018-16117

Sophos XG firewall  Admin Portal (17.0.8 MR-8) contains a shell escape vulnerability in /webconsole/Controller where the POST parameter dbName can be tainted with shell metacharacters. An authenticated remote attacker can execute arbitrary OS commands on the device. The CVE is CVE-2018-16117; CV...

CVE-2019-12839: Improper Neutralization of Special Elements used in an OS Command

In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration txtSendmailPath parameter that allows authenticated attackers to achieve arbitrary command execution...

CVE-2019-10925: Improper Access Control

A vulnerability has been identified in SIMATIC MV400 family All Versions V7.0.6. An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserver. The security vulnerability can be exploited by an attacker with network access to the device. Val...

CVE-2019-11231: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content PHP code, for example. This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to th...

CVE-2019-5944: Undefined Security Weakness

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address' without modify privileges via the application 'Address'...

CVE-2019-5931: Improper Input Validation

Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors...

CVE-2019-5943: Undefined Security Weakness

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privileges via the application 'Bulletin' and the application 'Cabinet'...