CVE-2019-10766 (pixie)

Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.

Source

/by

CVE-2019-12422 (shiro)

Apache Shiro before 1.4.2, when using the default “remember me” configuration, cookies could be susceptible to a padding attack.

Source

/by

CVE-2014-5118 (enterprise_linux, fedora, trusted_boot)

A Security Bypass Vulnerability exists in TBOOT before 1.8.2 in the boot loader module when measuring commandline parameters.

Source

/by

CVE-2012-4441 (jenkins)

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.

Source

/by

CVE-2012-4440 (jenkins)

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin.

Source

/by

CVE-2019-10764 (elliptic-php)

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.

Source

/by

CVE-2019-19117 (k2(psg1218)_firmware)

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter.

Source

/by

CVE-2008-7273 (iceweasel-firegpg)

A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.

Source

/by

CVE-2019-15054 (mailbird)

Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a privileged context via a crafted HTML mail message. This vulnerability is distinct from CVE-2015-4657.

Source

/by