|
225001
|
6.1 |
MEDIUM
Network
|
openproject
|
openproject
|
An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages …
|
CWE-79
Cross-site Scripting
|
CVE-2019-17092
|
2024-11-21 13:31 |
2019-10-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225002
|
7.5 |
HIGH
Network
|
netreo
|
omnicenter
|
Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page through a GET request. The injection allows…
|
CWE-89
SQL Injection
|
CVE-2019-17128
|
2024-11-21 13:31 |
2019-10-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225003
|
9.8 |
CRITICAL
Network
|
kramerav
|
viaware
|
Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
|
CWE-276
Incorrect Default Permissions
|
CVE-2019-17124
|
2024-11-21 13:31 |
2019-10-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225004
|
8.8 |
HIGH
Network
|
fiberhome
|
hg2201t_firmware
|
/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution.
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2019-17186
|
2024-11-21 13:31 |
2019-10-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225005
|
9.1 |
CRITICAL
Network
|
opendev canonical
|
octavia ubuntu_linux
|
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve …
|
CWE-287
Improper Authentication
|
CVE-2019-17134
|
2024-11-21 13:31 |
2019-10-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225006
|
7.5 |
HIGH
Network
|
fiberhome
|
hg2201t_firmware
|
/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for reading arbitrary files.
|
CWE-22
Path Traversal
|
CVE-2019-17187
|
2024-11-21 13:31 |
2019-10-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225007
|
5.3 |
MEDIUM
Network
|
centreon
|
centreon_web
|
The token generator in index.php in Centreon Web before 2.8.27 is predictable.
|
CWE-330
Use of Insufficiently Random Values
|
CVE-2019-17105
|
2024-11-21 13:31 |
2019-10-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225008
|
6.1 |
MEDIUM
Network
|
centreon
|
centreon_web
|
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.
|
CWE-79
Cross-site Scripting
|
CVE-2019-17108
|
2024-11-21 13:31 |
2019-10-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225009
|
8.8 |
HIGH
Network
|
centreon
|
centreon_web
|
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this…
|
CWE-78
OS Command
|
CVE-2019-17107
|
2024-11-21 13:31 |
2019-10-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225010
|
6.5 |
MEDIUM
Network
|
centreon
|
centreon_web
|
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
|
CWE-312
Cleartext Storage of Sensitive Information
|
CVE-2019-17106
|
2024-11-21 13:31 |
2019-10-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|