Total
3863 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-16759 | 1 Vbulletin | 1 Vbulletin | 2024-08-05 | 9.8 Critical |
| vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. | ||||
| CVE-2019-16774 | 1 Phpfastcache | 1 Phpfastcache | 2024-08-05 | 4.4 Medium |
| In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver. | ||||
| CVE-2019-16645 | 1 Embedthis | 1 Goahead | 2024-08-05 | 8.6 High |
| An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack. | ||||
| CVE-2019-16538 | 2 Jenkins, Redhat | 2 Script Security, Openshift | 2024-08-05 | 8.8 High |
| A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts. | ||||
| CVE-2019-16255 | 5 Debian, Opensuse, Oracle and 2 more | 8 Debian Linux, Leap, Graalvm and 5 more | 2024-08-05 | 8.1 High |
| Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. | ||||
| CVE-2019-16108 | 1 Phpbb | 1 Phpbb | 2024-08-05 | 7.5 High |
| phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode. | ||||
| CVE-2019-15873 | 1 Metagauss | 1 Profilegrid | 2024-08-05 | N/A |
| The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code. | ||||
| CVE-2019-15746 | 1 Sitos | 1 Sitos Six | 2024-08-05 | 9.8 Critical |
| SITOS six Build v6.2.1 allows an attacker to inject arbitrary PHP commands. As a result, an attacker can compromise the running server and execute system commands in the context of the web user. | ||||
| CVE-2019-15647 | 1 Groundhogg | 1 Groundhogg | 2024-08-05 | N/A |
| The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution. | ||||
| CVE-2019-15642 | 1 Webmin | 1 Webmin | 2024-08-05 | N/A |
| rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users." | ||||
| CVE-2019-15598 | 1 Treekill Project | 1 Treekill | 2024-08-05 | 9.8 Critical |
| A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. | ||||
| CVE-2019-15599 | 1 Tree-kill Project | 1 Tree-kill | 2024-08-05 | 9.8 Critical |
| A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. | ||||
| CVE-2019-15597 | 1 Node-df Project | 1 Node-df | 2024-08-05 | 9.8 Critical |
| A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input. | ||||
| CVE-2019-15388 | 1 Coolpad | 2 Mega 5, Mega 5 Firmware | 2024-08-05 | 8.1 High |
| The Coolpad 1851 Android device with a build fingerprint of Coolpad/android/android:8.1.0/O11019/1534834761:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.1.13). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. In addition to the local attack surface, its accompanying app with a package name of com.ekesoo.lovelyhifonts makes network requests using HTTP and an attacker can perform a Man-in-the-Middle (MITM) attack on the connection to inject a command in a network response that will be executed as the system user by the com.lovelyfont.defcontainer app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing commands as the system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more. | ||||
| CVE-2019-15318 | 1 Yikesinc | 1 Easy Forms For Mailchimp | 2024-08-05 | N/A |
| The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. | ||||
| CVE-2019-15224 | 1 Rest-client Project | 1 Rest-client | 2024-08-05 | N/A |
| The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected. | ||||
| CVE-2019-15087 | 1 Prise | 1 Adas | 2024-08-05 | 7.2 High |
| An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execution. | ||||
| CVE-2019-14965 | 1 Frappe | 1 Frappe | 2024-08-05 | N/A |
| An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists. | ||||
| CVE-2019-14827 | 1 Moodle | 1 Moodle | 2024-08-05 | 6.1 Medium |
| A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions. | ||||
| CVE-2019-14867 | 3 Fedoraproject, Freeipa, Redhat | 4 Fedora, Freeipa, Enterprise Linux and 1 more | 2024-08-05 | 8.8 High |
| A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server. | ||||