Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2624▼ 223 respecto a la semana anterior

Críticas / altas1373▲ 144 respecto a la semana anterior

Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)81▼ 449 respecto a la semana anterior

6 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2019-9926	Modificada	Alta (8.8)	1.9%	—	Labkey Server	29/10/2019	17/6/2026	An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewScriptReport.view CSRF vulnerability.
CVE-2019-9758	Modificada	Media (5.4)	1.0%	—	Labkey Server	29/10/2019	17/6/2026	An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/addUsers.view, or wiki/Administration/page.view in the admin panel, leading to privilege escalation.
CVE-2019-9757	Modificada	Alta (7.5)	37%	—	Labkey Server	29/10/2019	17/6/2026	An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.
CVE-2019-3913	Modificada	Media (4.9)	1.7%	—	Labkey Server	30/1/2019	17/6/2026	Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive on the system leading to denial of service.
CVE-2019-3912	Modificada	Media (6.1)	4.8%	—	Labkey Server	30/1/2019	17/6/2026	An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.
CVE-2019-3911	Modificada	Media (6.1)	3.8%	—	Labkey Server	30/1/2019	17/6/2026	Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.