Total
309476 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-14670 | 1 Firefly-iii | 1 Firefly Iii | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation. | |||||
| CVE-2019-14669 | 1 Firefly-iii | 1 Firefly Iii | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page. | |||||
| CVE-2019-14668 | 1 Firefly-iii | 1 Firefly Iii | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link. | |||||
| CVE-2019-14667 | 1 Firefly-iii | 1 Firefly Iii | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action. | |||||
| CVE-2019-14666 | 1 Glpi-project | 1 Glpi | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes. | |||||
| CVE-2019-14665 | 1 Brandy Project | 1 Brandy | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code. | |||||
| CVE-2019-14664 | 2 Enigmail, Fedoraproject | 2 Enigmail, Fedora | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
| In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, he unknowingly leaks the plaintext of the encrypted message part(s) back to the attacker. This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks. | |||||
| CVE-2019-14663 | 1 Brandy Project | 1 Brandy | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code. | |||||
| CVE-2019-14662 | 1 Brandy Project | 1 Brandy | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code. | |||||
| CVE-2019-14657 | 1 Yeahlink | 6 T49g, T49g Firmware, T58v and 3 more | 2024-11-21 | 9.0 HIGH | 8.8 HIGH |
| Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root. | |||||
| CVE-2019-14656 | 1 Yeahlink | 6 T49g, T49g Firmware, T58v and 3 more | 2024-11-21 | 9.0 HIGH | 8.8 HIGH |
| Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP. | |||||
| CVE-2019-14654 | 1 Joomla | 1 Joomla\! | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9. | |||||
| CVE-2019-14653 | 1 Ipandao | 1 Editor.md | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element. | |||||
| CVE-2019-14652 | 1 Amazon | 1 Aws Javascript S3 Explorer | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances. | |||||
| CVE-2019-14630 | 1 Intel | 26 Dsl3310 Thunderbolt, Dsl3310 Thunderbolt Firmware, Dsl3510 Thunderbolt and 23 more | 2024-11-21 | 2.1 LOW | 4.6 MEDIUM |
| Reliance on untrusted inputs in a security decision in some Intel(R) Thunderbolt(TM) controllers may allow unauthenticated user to potentially enable information disclosure via physical access. | |||||
| CVE-2019-14629 | 1 Intel | 1 Data Analytics Acceleration Library | 2024-11-21 | 2.1 LOW | 5.5 MEDIUM |
| Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access. | |||||
| CVE-2019-14626 | 1 Intel | 2 Field Programmable Gate Array Programmable Acceleration Card N3000, Field Programmable Gate Array Programmable Acceleration Card N3000 Firmware | 2024-11-21 | 4.6 MEDIUM | 6.7 MEDIUM |
| Improper access control in PCIe function for the Intel® FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable escalation of privilege via local access. | |||||
| CVE-2019-14625 | 1 Intel | 2 Field Programmable Gate Array Programmable Acceleration Card N3000, Field Programmable Gate Array Programmable Acceleration Card N3000 Firmware | 2024-11-21 | 2.1 LOW | 4.4 MEDIUM |
| Improper access control in on-card storage for the Intel® FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable denial of service via local access. | |||||
| CVE-2019-14620 | 1 Intel | 22 Ac 3165, Ac 3165 Firmware, Ac 3168 and 19 more | 2024-11-21 | 3.3 LOW | 6.5 MEDIUM |
| Insufficient control flow management for some Intel(R) Wireless Bluetooth(R) products may allow an unprivileged user to potentially enable denial of service via adjacent access. | |||||
| CVE-2019-14615 | 2 Canonical, Intel | 709 Ubuntu Linux, Atom E3805, Atom E3805 Firmware and 706 more | 2024-11-21 | 1.9 LOW | 5.5 MEDIUM |
| Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access. | |||||