CVE Vulnerability Catalog

An SSRF vulnerability in the ProxyServlet component of Zimbra Collaboration Suite. It allows an attacker to send requests from the server to internal resources.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8.

A vulnerability in the admin web interface of Pulse Secure (Pulse Connect Secure and Pulse Policy Secure) allows an authenticated attacker to inject and execute commands.

A vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise data integrity and confidentiality.

A path traversal vulnerability in the downloadallattachments resource in Confluence Server and Data Center. It allows writing files to arbitrary locations, potentially leading to remote code execution.

An elevation of privilege vulnerability in Windows, caused by improper handling of objects in memory by the Win32k component. A local attacker could exploit this to gain elevated privileges.

An elevation of privilege vulnerability in Windows AppX Deployment Service (AppXSVC), due to improper handling of hard links. A local attacker could exploit this to gain elevated privileges.

An elevation of privilege vulnerability in Windows, caused by improper handling of objects in memory by the Win32k component. A local attacker could exploit this to gain elevated privileges.

A remote code execution vulnerability exists in the scripting engine of Internet Explorer when handling objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, and CVE-2019-0862.

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704 and CVE-2019-0821.

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the 'TestEmail' functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

In Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions, missing validation of security headers allows bypassing authentication in the staging service and deserializing user-controlled .NET objects. This leads to unauthenticated remote code execution on the server hosting Kentico.

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process on the host system.

The Widget Connector macro in Atlassian Confluence Server before versions 6.6.12, 6.12.3, 6.13.3, and 6.14.2 allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.