|
212151
|
7.5 |
HIGH
Network
|
linux
canonical
opensuse
debian
|
linux_kernel
ubuntu_linux
leap
debian_linux
|
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
|
CWE-401
Missing Release of Memory after Effective Lifetime
|
CVE-2019-8980
|
2024-11-21 13:50 |
2019-02-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212152
|
9.8 |
CRITICAL
Network
|
kohanaframework
|
kohana
|
Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled.
|
CWE-89
SQL Injection
|
CVE-2019-8979
|
2024-11-21 13:50 |
2019-02-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212153
|
8.8 |
HIGH
Network
|
indexhibit
|
indexhibit
|
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI.
|
CWE-20
Improper Input Validation
|
CVE-2019-8954
|
2024-11-21 13:50 |
2019-02-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212154
|
6.1 |
MEDIUM
Network
|
netgate
|
haproxy
|
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.
|
CWE-79
Cross-site Scripting
|
CVE-2019-8953
|
2024-11-21 13:50 |
2019-02-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212155
|
9.8 |
CRITICAL
Network
|
dasannetworks
|
h665_firmware
|
The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET.
|
CWE-798
Use of Hard-coded Credentials
|
CVE-2019-8950
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212156
|
9.8 |
CRITICAL
Network
|
papercut
|
papercut_mf
papercut_ng
|
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
|
CWE-74
Injection
|
CVE-2019-8948
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212157
|
6.5 |
MEDIUM
Network
|
octopus
|
octopus_deploy
octopus_server
|
An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variab…
|
CWE-532
Inclusion of Sensitive Information in Log Files
|
CVE-2019-8944
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212158
|
6.5 |
MEDIUM
Network
|
wordpress
|
wordpress
|
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two …
|
CWE-22
Path Traversal
|
CVE-2019-8943
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212159
|
8.8 |
HIGH
Network
|
wordpress
debian
|
wordpress
debian_linux
|
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php su…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2019-8942
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212160
|
6.1 |
MEDIUM
Network
|
tautulli
|
tautulli
|
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.
|
CWE-79
Cross-site Scripting
|
CVE-2019-8939
|
2024-11-21 13:50 |
2019-02-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
