|
214621
|
6.1 |
MEDIUM
Network
|
netgate
|
haproxy
|
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.
|
CWE-79
Cross-site Scripting
|
CVE-2019-8953
|
2024-11-21 13:50 |
2019-02-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214622
|
9.8 |
CRITICAL
Network
|
dasannetworks
|
h665_firmware
|
The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET.
|
CWE-798
Use of Hard-coded Credentials
|
CVE-2019-8950
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214623
|
9.8 |
CRITICAL
Network
|
papercut
|
papercut_mf
papercut_ng
|
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
|
CWE-74
Injection
|
CVE-2019-8948
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214624
|
6.5 |
MEDIUM
Network
|
octopus
|
octopus_deploy
octopus_server
|
An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variab…
|
CWE-532
Inclusion of Sensitive Information in Log Files
|
CVE-2019-8944
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214625
|
6.5 |
MEDIUM
Network
|
wordpress
|
wordpress
|
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two …
|
CWE-22
Path Traversal
|
CVE-2019-8943
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214626
|
8.8 |
HIGH
Network
|
wordpress
debian
|
wordpress
debian_linux
|
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php su…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2019-8942
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214627
|
6.1 |
MEDIUM
Network
|
tautulli
|
tautulli
|
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.
|
CWE-79
Cross-site Scripting
|
CVE-2019-8939
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214628
|
5.4 |
MEDIUM
Network
|
o-dyn
|
collabtive
|
Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter.
|
CWE-79
Cross-site Scripting
|
CVE-2019-8935
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214629
|
8.8 |
HIGH
Network
|
dedecms
|
dedecms
|
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2019-8933
|
2024-11-21 13:50 |
2019-02-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214630
|
7.5 |
HIGH
Network
|
seafile
|
seadroid
|
The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making …
|
CWE-330
Use of Insufficiently Random Values
|
CVE-2019-8919
|
2024-11-21 13:50 |
2019-02-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
