Monthly Archive: June 2019

CVE-2019-1623

A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root user. The vulnerability is due to insufficient input validation during...

CVE-2019-12904

** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where...

CVE-2019-12903

Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information....

CVE-2019-12902

Pydio Cells before 1.5.0 does incomplete cleanup of a user’s data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user’s data. Date...

CVE-2019-12901

Pydio Cells before 1.5.0 fails to neutralize ‘../’ elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation. Date published : 2019-06-19...

CVE-2019-12890

RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework users insert_one call. Date published : 2019-06-19 https://www.exploit-db.com/exploits/46992