Recent vulnerabilities and exploits

NA
CVE-2019-15130

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a...

NA
CVE-2019-15129

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a...

7.2
CVSSv2
CVE-2018-8440

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008,...

MicrosoftWindows 10Windows 7Windows 8.1Windows Rt 8.1Windows Server 2008Windows Server 2012Windows Server 2016
2.1
CVSSv2
CVE-2019-0636

An information vulnerability exists when Windows improperly discloses file information, aka 'Windows Information Disclosure Vulnerability'....

NA
CVE-2018-1689

#BlackHat2019 memo first Sesstion Privilege escalation bugs Restricted user Call -> System Service(RPC) -> Tergetfile CVE-2018-8440 GitHub - sourceincite/CVE-2018-8440: CVE-2018-8440 standalone exploit DACL rewrite call SchRpcSetSecurity win.iniから TOCTOU Read...

10
CVSSv2
CVE-2017-16088

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox....

Safe-eval ProjectSafe-eval
NA
CVE-2019-15137

The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network....

NA
CVE-2019-15135

The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for attackers to discover potentially sensitive...

NA
CVE-2019-15136

The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition....

7.5
CVSSv2
CVE-2019-11707

A type confusion vulnerability has been found in Firefox 67.0.3 and Firefox ESR 60.7.1. The vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. It can allow remote code execution....

MozillaFirefoxFirefox EsrThunderbird