dwf — recent CVEs

CVE-2017-1002201

Tue, 15 Oct 2019 17:35:57 GMT

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additi…

CVE-2019-1020002

Mon, 29 Jul 2019 14:25:23 GMT

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

CVE-2019-1020004

Mon, 29 Jul 2019 14:20:39 GMT

Tridactyl before 1.16.0 allows fake key events.

CVE-2019-1020007

Mon, 29 Jul 2019 14:18:52 GMT

Dependency-Track before 3.5.1 allows XSS.

CVE-2019-1020009

Mon, 29 Jul 2019 14:17:02 GMT

Fleet before 2.1.2 allows exposure of SMTP credentials.

CVE-2019-1020008

Mon, 29 Jul 2019 14:14:54 GMT

stacktable.js before 1.0.4 allows XSS.

CVE-2019-1020006

Mon, 29 Jul 2019 14:10:07 GMT

invenio-app before 1.1.1 allows host header injection.

CVE-2019-1020005

Mon, 29 Jul 2019 14:07:05 GMT

invenio-communities before 1.0.0a20 allows XSS.

CVE-2019-1020003

Mon, 29 Jul 2019 14:03:57 GMT

invenio-records before 1.2.2 allows XSS.

CVE-2019-1020019

Mon, 29 Jul 2019 13:16:32 GMT

invenio-previewer before 1.0.0a12 allows XSS.

CVE-2019-1020018

Mon, 29 Jul 2019 13:14:16 GMT

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.

CVE-2019-1020017

Mon, 29 Jul 2019 12:25:59 GMT

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.

CVE-2019-1020016

Mon, 29 Jul 2019 12:23:12 GMT

ASH-AIO before 2.0.0.3 allows an open redirect.

CVE-2019-1020015

Mon, 29 Jul 2019 12:21:40 GMT

graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.

CVE-2019-1020014

Mon, 29 Jul 2019 12:20:21 GMT

docker-credential-helpers before 0.6.3 has a double free in the List functions.

CVE-2019-1020013

Mon, 29 Jul 2019 12:18:07 GMT

parse-server before 3.6.0 allows account enumeration.

CVE-2019-1020012

Mon, 29 Jul 2019 12:16:14 GMT

parse-server before 3.4.1 allows DoS after any POST to a volatile class.

CVE-2019-1020011 · 9 CRITICAL

Mon, 29 Jul 2019 12:13:43 GMT

SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.

CVE-2019-1020010

Mon, 29 Jul 2019 12:12:04 GMT

Misskey before 10.102.4 allows hijacking a user's token.

CVE-2019-1020001

Mon, 29 Jul 2019 00:00:00 GMT

yard before 0.9.20 allows path traversal.

CVE-2019-1010147

Thu, 25 Jul 2019 23:02:40 GMT

Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminSt…

CVE-2019-1010127

Thu, 25 Jul 2019 18:35:30 GMT

VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.c…

CVE-2019-1010161

Thu, 25 Jul 2019 13:17:52 GMT

perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-cont…

CVE-2019-1010172

Thu, 25 Jul 2019 13:13:15 GMT

Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component is: function jsiValueGetString (jsiUtils.c). The attack vector is: executing crafted javascript code. The fixed version is: after c…

CVE-2019-1010174

Thu, 25 Jul 2019 13:12:03 GMT

CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection, because no…

CVE-2019-1010176

Thu, 25 Jul 2019 13:05:09 GMT

JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function lit_char_to_utf8_bytes (jerry-core/lit/lit-char-helpers.c:…

CVE-2019-1010182

Thu, 25 Jul 2019 13:02:57 GMT

yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The f…

CVE-2019-1010183

Thu, 25 Jul 2019 12:50:56 GMT

serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a malicious YAML file. The fixed v…

CVE-2019-1010178

Wed, 24 Jul 2019 13:50:45 GMT

Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change dat…

CVE-2019-1010179

Wed, 24 Jul 2019 13:44:50 GMT

PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injection'). The impact is: It is possible to manipulate gpg-keys or execute commands remotely. The…

CVE-2019-1010189

Wed, 24 Jul 2019 13:16:51 GMT

mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local, the user should open a specially crafted file. The fixed version is: 1.2.1…

CVE-2019-1010191

Wed, 24 Jul 2019 13:10:33 GMT

marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for ins…

CVE-2019-1010193

Wed, 24 Jul 2019 12:50:16 GMT

hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).

CVE-2019-1010190

Wed, 24 Jul 2019 12:11:58 GMT

mgetty prior to 1.2.1 is affected by: out-of-bounds read. The impact is: DoS, the program may crash if the memory is not mapped. The component is: putwhitespan() in g3/pbm2g3.c. The attack vector is: Local, the victim must open a specially crafted fi…

CVE-2019-1010180

Wed, 24 Jul 2019 12:01:08 GMT

GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging.…

CVE-2019-1010177

Wed, 24 Jul 2019 11:52:20 GMT

Jsish 2.4.70 2.047 is affected by: Use After Free. The impact is: denial of service and possibly arbitrary code execution. The component is: function Jsi_RegExpNew (jsi/jsiRegexp.c:39). The attack vector is: executing crafted javascript code. The fix…

CVE-2019-1010163

Wed, 24 Jul 2019 11:42:32 GMT

Socusoft Co Photo 2 Video Converter 8.0.0 is affected by: Buffer Overflow - Local shell-code execution and Denial of Service. The impact is: Local privilege escalation (dependant upon conditions), shell code execution and denial-of-service. The compo…

CVE-2019-1010199

Tue, 23 Jul 2019 17:17:14 GMT

ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The att…

CVE-2019-1010200

Tue, 23 Jul 2019 17:15:40 GMT

Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The impact is: Rem…

CVE-2019-1010201

Tue, 23 Jul 2019 17:07:14 GMT

Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateProcInsIdByBusinessId() function in src/main/java/com.thinkgem.jeesite/modules/act/ActDao.java has SQL Injection vulnerability. The…

CVE-2019-1010173

Tue, 23 Jul 2019 14:00:56 GMT

Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function Jsi_ValueArrayIndex (jsiValue.c:366). The attack vector is: executing crafted javascript code. The fixed version is: after commit 73…

CVE-2019-1010202

Tue, 23 Jul 2019 13:52:49 GMT

Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The attack vector…

CVE-2019-1010171

Tue, 23 Jul 2019 13:43:28 GMT

Jsish 2.4.83 2.0483 is affected by: Nullpointer dereference. The impact is: denial of service. The component is: function jsi_DumpFunctions (jsiEval.c:567). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.84.

CVE-2019-1010170

Tue, 23 Jul 2019 13:41:54 GMT

Jsish 2.4.77 2.0477 is affected by: Use After Free. The impact is: denial of service. The component is: function Jsi_ObjFree (jsiObj.c:230). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.

CVE-2019-1010169

Tue, 23 Jul 2019 13:40:08 GMT

Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function lexer_getchar (jsiLexer.c:9). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.

CVE-2019-1010204

Tue, 23 Jul 2019 13:39:02 GMT

GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:…

CVE-2019-1010205

Tue, 23 Jul 2019 13:35:44 GMT

LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impact is: The vulnerability allows an attacker to access any file (with a fixed extension) on the server. The component is: A web-view…

CVE-2019-1010206

Tue, 23 Jul 2019 13:30:18 GMT

OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.

CVE-2019-1010162

Tue, 23 Jul 2019 13:28:53 GMT

jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcmpDict (jsiChar.c:121). The attack vector is: The victim must execute crafted javascript code. The fixed versi…

CVE-2019-1010155 🤔

Tue, 23 Jul 2019 13:18:36 GMT

D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is access…