Vulnerabilities (CVE)

Filter

127277 total CVE
CVE Vendors Products Updated CVSS
CVE-2017-1000227 1 Parallelus 1 Salutation 2019-08-24 3.5
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can
CVE-2019-14809 2 Golang, Debian 2 Go, Debian Linux 2019-08-24 7.5
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is...
CVE-2019-14459 1 Nfdump Project 1 Nfdump 2019-08-24 5.0
nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).
CVE-2019-1010057 1 Nfdump Project 1 Nfdump 2019-08-24 6.8
nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The component is: nfx.c:546, nffile_inline.c:83, minilzo.c (redistributed). The attack vector is:...
CVE-2014-1972 1 Apache 1 Tapestry 2019-08-24 7.8
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted...
CVE-2019-1010305 3 Kyzer, Canonical, Fedoraproject 3 Libmspack, Ubuntu Linux, Fedora 2019-08-23 4.3
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted...
CVE-2019-1010247 2019-08-23 4.3
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File:...
CVE-2016-6154 2019-08-23 N/A
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-9518 2 Apache, Apple 2 Traffic Server, Swiftnio 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS,...
CVE-2019-9517 2 Apache, Apple 2 Traffic Server, Swiftnio 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window...
CVE-2019-9516 6 Apache, Apple, Synology and 3 more 8 Traffic Server, Swiftnio, Diskstation Manager and 5 more 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or...
CVE-2019-9515 2 Apache, Apple 2 Traffic Server, Swiftnio 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per...
CVE-2019-9514 3 Apache, Apple, Debian 3 Traffic Server, Swiftnio, Debian Linux 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from...
CVE-2019-9513 6 Apache, Apple, Synology and 3 more 8 Traffic Server, Swiftnio, Diskstation Manager and 5 more 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to...
CVE-2019-9512 3 Apache, Apple, Debian 3 Traffic Server, Swiftnio, Debian Linux 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently...
CVE-2019-9511 6 Apache, Apple, Synology and 3 more 8 Traffic Server, Swiftnio, Diskstation Manager and 5 more 2019-08-23 7.8
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple...
CVE-2019-6695 2019-08-23 N/A
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-5594 2019-08-23 N/A
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-1552 1 Openssl 1 Openssl 2019-08-23 1.9
OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix /...
CVE-2019-15092 2019-08-23 N/A
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the...