CVE-2019-5264: Undefined Security Weakness

There is an information disclosure vulnerability in certain Huawei smartphones Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9. The software does not properly handle certain information of applications locked by applock in a rare conditio...

CVE-2019-5225

P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193C00E190R1P21, versions earlier than Hima-AL00B 9.1.0.135C00E200R2P1, versions earlier than VOGUE-AL00A 9.1.0.193C00E190R1P12 have a buffer overflow vulnerability on several , the system does not properly...

CVE-2019-5231

P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186C00E180R2P1 have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package...

CVE-2019-15815

ZyXEL P-1302-T10D v3 devices with firmware version 2.00ABBX.3 and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges...

Design/Logic Flaw

ZyXEL P-1302-T10D v3 devices with firmware version 2.00ABBX.3 and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges...

FlexAir Access Control 2.3.38 Command Injection

!/bin/bash Command injection with root privileges in FlexAir Access Control Prima Systems Firmware version: $OUTPUTFILE" Command injection payload. Be careful with single quotes! PAYLOAD="" Perform exploit echo "Executing: $CMD" curl --silent --output /dev/null -X POST -d "$PAYLOAD"...

CVE-2019-15815: Authorization Bypass Through User-Controlled Key

ZyXEL P-1302-T10D v3 devices with firmware version 2.00ABBX.3 and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges...

iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure

Summary The 4/8/16 channel hybrid standalone DVR delivers high quality pictures which adopts high performance video processing chips and embedded Linux system. This advanced video digital platform is very useful to identify an object from a long distance. Description The DVR suffers from an...

PT-2019-4401

Name of the Vulnerable Software and Affected Versions ZyXEL P-1302-T10D v3 devices with firmware version 2.00ABBX.3 and earlier Description The issue is related to inadequate access control in the firmware of the ZyXEL P-1302-T10D v3 router. This could allow an unauthorized user to access certain...

SQL Injection Vulnerability in p****t.asp page of Dragon Pulse Technology website builder system

Founded in July 2005, Dragon Pulse Technology is dedicated to website construction, animation design, program development, domain name space services, network services and information services for enterprises and individuals. SQL injection vulnerability exists in the pt.asp page of the website...

PT-2019-15174

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

PT-2019-15150

Name of the Vulnerable Software and Affected Versions Adhouma CMS versions prior to 2019-10-09 Description The issue allows for SQL Injection via the p id parameter in the "post.php" endpoint. Recommendations For Adhouma CMS versions prior to 2019-10-09, avoid using the p id parameter in the...

CVE-2019-17417

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

CVE-2016-7056

A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys...

CVE-2019-11341

On Samsung P(9.0) devices, the vulnerability enables a physically proximate attacker to start a TCP dump via the Service Mode feature (accessible after entering the *#9900# check code) without user knowledge. The OTP that protects this feature is generated locally, and the password creation logic...

PT-2019-15142

Name of the Vulnerable Software and Affected Versions PbootCMS version 2.0.2 Description The issue allows for XSS attacks through specific URI vectors. The affected API endpoints include "Pboot/admin.php?p=/Single/index/mcode/1" and "Pboot/?contact/". Recommendations For PbootCMS version 2.0.2,...

PT-2019-12249

Name of the Vulnerable Software and Affected Versions Samsung P version 9.0 Description The issue allows an attacker with physical access to start a TCP Dump capture without the user's knowledge by exploiting a feature in the Service Mode application. This application is accessible after entering...

CVE-2019-17417: Improper Neutralization of Input During Web Page Generation

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

CVE-2019-11341: Use of a Broken or Risky Cryptographic Algorithm

On certain Samsung P9.0 phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. This feature of the Service Mode application is available after entering the 9900 check code, but is protected by an OTP password. However, this password is created locally...

SQL injection vulnerability in p****t.asp page of basic website building system of Shenzhen Tiandixin Network Technology Co.

Tiandixin network was founded in 2010, is a strategic research and development-oriented enterprises, many large-scale project experience, more than tens of thousands of Chinese enterprises common choice of website platform builder, the company mainly focuses on corporate website construction, Bai...