|
219091
|
6.1 |
MEDIUM
Network
|
yunucms
|
yunucms
|
YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by site_title in an admin/system/basic POST request.
|
CWE-79
Cross-site Scripting
|
CVE-2019-5310
|
2024-11-21 13:44 |
2019-01-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219092
|
7.2 |
HIGH
Network
|
vtiger
|
vtiger_crm
|
Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into th…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2019-5009
|
2024-11-21 13:44 |
2019-01-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219093
|
7.1 |
HIGH
Local
|
foxitsoftware
|
foxit_reader phantompdf
|
An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information Disclosure and crash due to a NULL pointer dereference when reading TIFF data dur…
|
CWE-125 CWE-476
Out-of-bounds Read NULL Pointer Dereference
|
CVE-2019-5007
|
2024-11-21 13:44 |
2019-01-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219094
|
5.5 |
MEDIUM
Local
|
foxitsoftware
|
foxit_reader phantompdf
|
An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is a NULL pointer dereference during PDF parsing.
|
CWE-476
NULL Pointer Dereference
|
CVE-2019-5006
|
2024-11-21 13:44 |
2019-01-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219095
|
5.5 |
MEDIUM
Local
|
foxitsoftware
|
foxit_reader phantompdf
|
An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. They allowed Denial of Service (application crash) via image data, because two bytes are written to the end of the alloca…
|
CWE-787
Out-of-bounds Write
|
CVE-2019-5005
|
2024-11-21 13:44 |
2019-01-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219096
|
9.8 |
CRITICAL
Network
|
ibm
|
financial_transaction_manager
|
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.9 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which coul…
|
CWE-89
SQL Injection
|
CVE-2019-4575
|
2024-11-21 13:43 |
2022-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219097
|
2.4 |
LOW
Physics
|
ibm
|
maximo_anywhere
|
IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494.
|
NVD-CWE-noinfo
|
CVE-2019-4352
|
2024-11-21 13:43 |
2022-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219098
|
4.6 |
MEDIUM
Physics
|
ibm
|
maximo_anywhere
|
IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493.
|
NVD-CWE-noinfo
|
CVE-2019-4351
|
2024-11-21 13:43 |
2022-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219099
|
6.5 |
MEDIUM
Network
|
ibm
|
maximo_anywhere
|
IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 160697.
|
CWE-326
Inadequate Encryption Strength
|
CVE-2019-4291
|
2024-11-21 13:43 |
2022-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219100
|
5.4 |
MEDIUM
Network
|
ibm netapp
|
cognos_analytics oncommand_insight
|
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot…
|
CWE-79
Cross-site Scripting
|
CVE-2019-4653
|
2024-11-21 13:43 |
2021-06-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|