564 vulnerabilidades · Windows Orden: CVSS EPSS Año ID
CVE-2019-3591
Data Loss Prevention ePO extension Web Windows
3.9
LOW
EPSS
0.2%
2019 1 PoC

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

Scanner Automatizado
Sin template local disponible
CVE-2019-11046
PHP Web Windows
3.7
LOW
EPSS
8.2%
2019 CWE-125 1 PoC

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

Scanner Automatizado
Sin template local disponible
CVE-2019-11044
PHP Web Windows
3.7
LOW
EPSS
8.0%
2019 CWE-170 1 PoC

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Scanner Automatizado
Sin template local disponible
CVE-2019-1573
GlobalProtect Agent Networking Windows
2.5
LOW
EPSS
0.2%
2019 CWE-226 1 PoC

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the user.

Scanner Automatizado
Sin template local disponible
CVE-2019-15825
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
3.0%
2019 1 PoC

The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.

Scanner Automatizado
Sin template local disponible
CVE-2019-18368
Software Genérico Windows
N/A
UNKNOWN
EPSS
1.0%
2019 1 PoC

In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.

Scanner Automatizado
Sin template local disponible
CVE-2019-0732
Windows Windows
N/A
UNKNOWN
EPSS
3.8%
2019 2 PoCs

A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Security Feature Bypass Vulnerability'.

Scanner Automatizado
Sin template local disponible
CVE-2019-5005
Software Genérico Windows
N/A
UNKNOWN
EPSS
1.3%
2019 1 PoC

An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. They allowed Denial of Service (application crash) via image data, because two bytes are written to the end of the allocated memory without judging whether this will cause corruption.

Scanner Automatizado
Sin template local disponible
CVE-2019-17239
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
0.9%
2019 1 PoC

includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.

Scanner Automatizado
Sin template local disponible
CVE-2019-10250
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
0.7%
2019 1 PoC

UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.

Scanner Automatizado
Sin template local disponible
CVE-2019-17671
Software Genérico Web Windows ⚡ nuclei
N/A
UNKNOWN
EPSS
36.5%
2019 2 PoCs

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.

Scanner Automatizado
nuclei -t CVE-2019-17671.yaml ⎘
CVE-2019-9801
Thunderbird Windows
N/A
UNKNOWN
EPSS
1.3%
2019 1 PoC

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Scanner Automatizado
Sin template local disponible
CVE-2019-15833
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
1.0%
2019 1 PoC

The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.

Scanner Automatizado
Sin template local disponible
CVE-2019-17455
Software Genérico Windows
N/A
UNKNOWN
EPSS
3.1%
2019 2 PoCs

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

Scanner Automatizado
Sin template local disponible
CVE-2019-16525
Software Genérico Web Windows ⚡ nuclei
N/A
UNKNOWN
EPSS
5.5%
2019 2 PoCs

An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.

Scanner Automatizado
nuclei -t CVE-2019-16525.yaml ⎘
CVE-2019-14800
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
1.5%
2019 1 PoC

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.

Scanner Automatizado
Sin template local disponible
CVE-2019-11557
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
1.1%
2019 2 PoCs

The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

Scanner Automatizado
Sin template local disponible
CVE-2019-16219
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
1.9%
2019 1 PoC

WordPress before 5.2.3 allows XSS in shortcode previews.

Scanner Automatizado
Sin template local disponible
CVE-2019-14774
Software Genérico Web Windows
N/A
UNKNOWN
EPSS
1.0%
2019 2 PoCs

The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.

Scanner Automatizado
Sin template local disponible