PT-2019-17673 · Unknown · Serve-Here.Js

Name of the Vulnerable Software and Affected Versions: serve-here.js versions prior to 1.2.0 Description: The issue allows attackers to list any file in an arbitrary folder due to a path traversal vulnerability. This is caused by the package's failure to sanitize URLs, enabling attackers to acces...

Path Traversal in serve-here.js

Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later...

Undefined Behavior

Overview Versions of zencashjs prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction P2PKH or P2SH. Due to the base58 addre...

Nextcloud Extract App OS Command Injection Vulnerability

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany.Extract App is one of the compressed file extractor. An operating system command injection vulnerability exists in Nextcloud Extract App versions prior to 1.2.0. The...

CVE-2018-7803

A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to crash when sending a specially crafted packet. The emulator is used infrequently for application logic testing. It is susceptible to an...

SQLiteManager SQL Injection Vulnerability

SQLiteManager is a set of web-based SQLite database management tools that support multiple languages. A SQL injection vulnerability exists in SQLiteManager versions 1.2.0 and 1.2.4. A remote attacker can exploit this vulnerability to execute SQL commands...

GNU PSPP Denial of Service Vulnerability

GNU PSPP is the program used for statistical analysis of sampling data. A security vulnerability exists in the writelongstringmissingvalues function in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0. An attacker could exploit this vulnerability to cause a denial of service...

CVE-2019-9211

There is a reachable assertion abort in the function writelongstringmissingvalues in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead to denial of service...

CVE-2019-9211

There is a reachable assertion abort in the function writelongstringmissingvalues in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead to denial of service...

Security update for pspp, spread-sheet-widget (moderate)

openSUSE Security Update: Security update for pspp, spread-sheet-widget Announcement ID: openSUSE-SU-2019:0198-1 Rating: moderate References: 1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This...

CVE-2019-7412

The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values...

Security Bulletin: Vulnerabilities in SSLv3 affect IBM Flex System Manager (FSM) SMIA Configuration Tool (CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack and other vulnerabilities. SSLv3 is enabled in IBM FSM SMIA Configuration Tool commonly referred to as Network Advisor has addressed the applicable CVEs...

Security Bulletin: Vulnerabilities in Apache affect the IBM Flex System Manager (FSM): (CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231)

Summary Vulnerabilities in Apache affect the IBM Flex System Manager FSM: CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231 Vulnerability Details Abstract Vulnerabilities in Apache affect the IBM Flex System Manager FSM: CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231 Content...

Joomla MorfeoShow 1.2.0 SQL Injection

Exploit Title : Joomla MorfeoShow Components 1.2.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 31/01/2019 Vendor Homepage : joomla4ever.org Software Download Link : joomla4ever.org/archive/ext/commorfeoshow.zip Software Information Link :...

DEBIAN-CVE-2018-20723

A cross-site scripting XSS vulnerability exists in colortemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color...

CVE-2018-20726

CVE-2018-20726 affects Cacti (pre-1.2.0) with an XSS in host.php (via tree.php) due to missing escaping in the Website Hostname field for Devices. Exploitation details are not provided in the documents, but multiple advisories note this CVE alongside others and document remediation: upgrade to Ca...

LogonTracer Operating System Command Injection Vulnerability

LogonTracer is a visual Windows log analysis tool that checks for malicious logins by analyzing Windows Active Directory event logs. An operating system command injection vulnerability exists in LogonTracer version 1.2.0 and prior versions, which can be exploited by a remote attacker to execute...

LogonTracer Cross-Site Scripting Vulnerability

LogonTracer is a visual Windows log analysis tool that checks for malicious logins by analyzing Windows Active Directory event logs. A cross-site scripting vulnerability exists in LogonTracer version 1.2.0 and earlier versions, which can be exploited by remote attackers to execute arbitrary scrip...

CVE-2019-5886

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...

CVE-2019-5887

An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using "../" directory traversal...