|
225101
|
7.2 |
HIGH
Network
|
thecontrolgroup
|
voyager
|
An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a softw…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2019-17050
|
2024-11-21 13:31 |
2019-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225102
|
7.5 |
HIGH
Network
|
netgear
|
srx5308_firmware
|
NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account.
|
CWE-89
SQL Injection
|
CVE-2019-17049
|
2024-11-21 13:31 |
2019-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225103
|
10.0 |
CRITICAL
Network
|
themeisle
|
visualizer
|
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2019-16932
|
2024-11-21 13:31 |
2019-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225104
|
7.2 |
HIGH
Network
|
ilch
|
ilch_cms
|
Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page.
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2019-17046
|
2024-11-21 13:31 |
2019-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225105
|
4.8 |
MEDIUM
Network
|
ilch
|
ilch_cms
|
Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.
|
CWE-79
Cross-site Scripting
|
CVE-2019-17045
|
2024-11-21 13:31 |
2019-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225106
|
9.8 |
CRITICAL
Network
|
rsyslog
|
rsyslog
|
contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.
|
CWE-125
Out-of-bounds Read
|
CVE-2019-17040
|
2024-11-21 13:31 |
2019-09-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225107
|
9.8 |
CRITICAL
Network
|
idcos
|
cloudboot
|
CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI.
|
CWE-89
SQL Injection
|
CVE-2019-16999
|
2024-11-21 13:31 |
2019-09-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225108
|
7.2 |
HIGH
Network
|
metinfo
|
metinfo
|
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.
|
CWE-89
SQL Injection
|
CVE-2019-16997
|
2024-11-21 13:31 |
2019-09-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225109
|
7.2 |
HIGH
Network
|
metinfo
|
metinfo
|
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
|
CWE-89
SQL Injection
|
CVE-2019-16996
|
2024-11-21 13:31 |
2019-09-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
225110
|
4.7 |
MEDIUM
Local
|
linux redhat opensuse
|
linux_kernel enterprise_linux leap
|
In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12…
|
CWE-401
Missing Release of Memory after Effective Lifetime
|
CVE-2019-16994
|
2024-11-21 13:31 |
2019-09-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|