Security Vulnerabilities - CVEs Published In November 2019
If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.
CVSS Score
4.8
EPSS Score
0.001
Published
2019-11-12
ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges.
CVSS Score
6.5
EPSS Score
0.002
Published
2019-11-12
A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (DoS) condition because of Uncontrolled Resource Consumption.
CVSS Score
7.5
EPSS Score
0.007
Published
2019-11-12
A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information.
CVSS Score
7.5
EPSS Score
0.005
Published
2019-11-12
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
CVSS Score
7.5
EPSS Score
0.004
Published
2019-11-12
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
CVSS Score
7.5
EPSS Score
0.233
Published
2019-11-12
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
CVSS Score
5.3
EPSS Score
0.006
Published
2019-11-12
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
CVSS Score
6.1
EPSS Score
0.005
Published
2019-11-12
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.
CVSS Score
8.8
EPSS Score
0.003
Published
2019-11-12
File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution and obtain a command shell by sending a HTTP GET request including the malicious payload in the URL. A similar issue to CVE-2019-17415, CVE-2019-16724, and CVE-2010-2331.
CVSS Score
9.8
EPSS Score
0.435
Published
2019-11-12