PT-2019-7352

Name of the Vulnerable Software and Affected Versions users-ultra plugin versions prior to 1.5.63 Description The issue concerns a cross-site scripting XSS flaw. It is exploited via the p desc parameter. Recommendations For versions prior to 1.5.63, update to version 1.5.63 or later to resolve th...

PT-2019-7351

Name of the Vulnerable Software and Affected Versions users-ultra plugin versions prior to 1.5.63 Description The issue concerns a cross-site scripting XSS flaw. It is exploited via the p name parameter. Recommendations For versions prior to 1.5.63, update to version 1.5.63 or later to resolve th...

PT-2019-14623

Name of the Vulnerable Software and Affected Versions Indexhibit version 2.1.5 Description The issue allows for a product reinstallation, which can result in remote code execution. This can be achieved via the "/ndxzstudio/install.php?p=2" API endpoint. Recommendations For Indexhibit version 2.1....

S-CM e-commerce system aj***.php page P_sort parameter SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CM e-commerce system aj.php page Psort parameter SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive information...

CVE-2019-9444

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation...

DEBIAN-CVE-2019-9444

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-7364

CVE-2019-7364 describes a DLL preloading vulnerability in Autodesk products (2017–2020 Autodesk Advanced Steel, Civil 3D, AutoCAD and related tools; plus AutoCAD P&ID 2017). The issue allows an attacker to cause code execution by persuading a user to open a malicious DWG file that leverages the D...

CVE-2019-14783

On Samsung mobile devices with N7.x, and O8.x, P9.0 software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-2019-14764...

CVE-2019-3570

Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are configurable by an attacker for instance by providing the output of scryptenc in a context where Hack/PHP code would attempt to verify it by...

libvirt security update

5.0.0-9.el7 - qemu: remove cpuhostmask and cpuguestmask from virCaps structure Wim ten Have Orabug: 29956508 5.0.0-8.el7 - api: disallow virDomainSaveImageGetXMLDesc on read-only connections Jan Tomko Orabug: 29955742 CVE-2019-10161 - domain: Define explicit flags for saved image xml Eric Blake...

Linear eMerge 50P/5000P File Upload Vulnerability

The Linear eMerge 50P/5000P is an access control security system managed through a browser from Nortek Security & Control. A file upload vulnerability exists in the Linear eMerge 50P/5000P. An attacker could use this vulnerability to upload a file with an arbitrary extension to a directory in the...

CVE-2019-7270

Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery CSRF...

PT-2019-13053

Name of the Vulnerable Software and Affected Versions LiveZilla Server versions prior to 8.0.1.1 Description The issue concerns SQL Injection in the functions.internal.build.inc.php file via the p dt s d parameter. Recommendations For versions prior to 8.0.1.1, update to version 8.0.1.1 or later ...

PT-2019-13038

Name of the Vulnerable Software and Affected Versions LiveZilla Server versions prior to 8.0.1.1 Description The issue concerns SQL Injection in the server.php file via the p ext rse parameter. Recommendations For versions prior to 8.0.1.1, update to version 8.0.1.1 or later to resolve the issue...

USN-4021-1: libvirt vulnerabilities

Daniel P. Berrangé discovered that libvirt incorrectly handled socket permissions. A local attacker could possibly use this issue to access libvirt. CVE-2019-10132 It was discovered that libvirt incorrectly performed certain permission checks. A remote attacker could possibly use this issue to...

ZyXEL P-660HN-T1 V2 Missing Authentication / Password Disclosure Vulnerabilities

Exploit for hardware platform in category web applications Description: The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 2.00AAKK.3 devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the...

CVE-2019-6725

The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 2.00AAKK.3 devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the interface of the modem can be accessed as admin...

Design/Logic Flaw

The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 2.00AAKK.3 devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the interface of the modem can be accessed as admin...

CVE-2019-6725

Summary (CVE-2019-6725): Affected device: ZyXEL P-660HN-T1 V2 with firmware 2.00(AAKK.3). The rpWLANRedirect.asp page is accessible without authentication, allowing an admin password to be read from the HTML source and enabling interface access as admin. This leads to complete control of the mode...

CVE-2019-6725

The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 2.00AAKK.3 devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the interface of the modem can be accessed as admin...