Security Vulnerabilities - CVEs Published In November 2019
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
CVSS Score
9.8
EPSS Score
0.94
Published
2019-11-07
Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiVectorRender!StrokeText_Blend+0x00000000000003a7.
CVSS Score
5.5
EPSS Score
0.001
Published
2019-11-07
Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.
CVSS Score
5.5
EPSS Score
0.001
Published
2019-11-07
Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfile::BuildGradientColorsTable+0x0000000000000053.
CVSS Score
5.5
EPSS Score
0.001
Published
2019-11-07
The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.
CVSS Score
7.5
EPSS Score
0.002
Published
2019-11-07
syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot.
CVSS Score
9.8
EPSS Score
0.005
Published
2019-11-07
ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
CVSS Score
5.5
EPSS Score
0.001
Published
2019-11-07
Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor.
CVSS Score
6.1
EPSS Score
0.004
Published
2019-11-07
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_update.php bo_content_tail parameter.
CVSS Score
6.1
EPSS Score
0.007
Published
2019-11-07
The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security.
CVSS Score
6.2
EPSS Score
0.001
Published
2019-11-07