CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
2019-08-06
N/A
6.5 MEDIUM
There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.
2019-08-06
N/A
6.5 MEDIUM
There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none.
JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of < in a message, because a danmuWrapper DIV element in chatbox-onlydanmu.js is outside the scope of a Content Security Policy (CSP).
M365_firmware, M365, Mi_5s_plus_firmware, Mi_5s_plus, Redmi_6_firmware, Redmi_6, Redmi_5_firmware, Redmi_5, 5s_plus_firmware, 5s_plus
2022-04-19
N/A
5.3 MEDIUM
Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.