The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2019-8337 | In msmtp 1.8.2, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. | -- | Feb 13, 2019 | -- (VxWorks 7) |
| CVE-2019-8335 | An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS]. | Medium | Feb 13, 2019 | -- (VxWorks 7) |
| CVE-2019-8334 | An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS]. | Medium | Feb 13, 2019 | -- (VxWorks 7) |
| CVE-2019-8319 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv4Settings API function, as demonstrated by shell metacharacters in the Gateway field. | -- | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8318 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field. | High | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8317 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field. | -- | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8316 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field. | -- | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8315 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field. | -- | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8314 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field. | -- | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8313 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv6AddressRangeStart field. | High | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8312 | An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field. | -- | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-8308 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file. | -- | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7753 | Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter. | Medium | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7748 | _includes\\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists. | Medium | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7747 | DbNinja 3.2.7 allows session fixation via the data.php sessid parameter. | Medium | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7744 | An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability. | Medium | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7743 | An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files. | High | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7742 | An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector. | Medium | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7741 | An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS. | Medium | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7740 | An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector. | Medium | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7739 | An issue was discovered in Joomla! before 3.9.3. The No Filtering textfilter overrides child settings in the Global Configuration. This is intended behavior. However, it might be unexpected for the user because the configuration dialog lacks an additional message to explain this. | Medium | Feb 12, 2019 | -- (VxWorks 7) |
| CVE-2019-7738 | C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI. | Medium | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7737 | A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit. | Medium | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7736 | D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. | High | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7733 | In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove. | Medium | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7732 | In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed. | Medium | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7731 | MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function with a .php filename for the backup\'s archive file. | High | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7730 | MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI. | Medium | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7722 | PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.) | -- | Feb 11, 2019 | -- (VxWorks 7) |
| CVE-2019-7721 | lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7720 | taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php db_name parameter and then making a config.php request. | High | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7719 | Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request. | High | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7718 | An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.class.php creates bakup_tables.php temporarily. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7704 | wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7703 | In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7702 | A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7701 | A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm2js. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7700 | A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7699 | A heap-based buffer over-read occurs in AP4_BitStream::WriteBytes in Codecs/Ap4BitStream.cpp in Bento4 v1.5.1-627. Remote attackers could leverage this vulnerability to cause an exception via crafted mp4 input, which leads to a denial of service. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7698 | An issue was discovered in AP4_Array<AP4_CttsTableEntry>::EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demonstrated by mp42hls, a related issue to CVE-2018-20095. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7697 | An issue was discovered in Bento4 v1.5.1-627. There is an assertion failure in AP4_AtomListWriter::Action in Core/Ap4Atom.cpp, leading to a denial of service (program crash), as demonstrated by mp42hls. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7693 | Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter. In some situations, the XSS would be on the family.axioscloud.it cloud service; however, the vendor also supports Sissi in Rete (con server) for offline operation. | Medium | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7692 | install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration file mishandling in the N=83 case, as demonstrated by a call to the PHP fputs function that creates a .php file in the public folder. | -- | Feb 10, 2019 | -- (VxWorks 7) |
| CVE-2019-7684 | inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadController#gok4 (com/inxedu/os/common/controller/VideoUploadController.java). The attacker uses the /video/uploadvideo fileType parameter to change the list of acceptable extensions from jpg,gif,png,jpeg to jpg,gif,png,jsp,jpeg. | -- | Feb 9, 2019 | -- (VxWorks 7) |
| CVE-2019-7678 | A directory traversal vulnerability was discovered in Enphase Envoy R3.*.* via images/, include/, include/js, or include/css on TCP port 8888. | High | Feb 9, 2019 | -- (VxWorks 7) |
| CVE-2019-7677 | XSS exists in Enphase Envoy R3.*.* via the profileName parameter to the /home URI on TCP port 8888. | Medium | Feb 9, 2019 | -- (VxWorks 7) |
| CVE-2019-7676 | A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account. | -- | Feb 9, 2019 | -- (VxWorks 7) |
| CVE-2019-7675 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic Authentication, as demonstrated by the /admin/index.html URI. | Medium | Feb 9, 2019 | -- (VxWorks 7) |
| CVE-2019-7674 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. /admin/access accepts a request to set the aaaaa password, considered insecure for some use cases, from a user. | Medium | Feb 9, 2019 | -- (VxWorks 7) |
| CVE-2019-7673 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. Administrator Credentials are stored in the 13-character DES hash format. | Medium | Feb 9, 2019 | -- (VxWorks 7) |
