1736 matches found
Security Bulletin: IBM WebSphere Cast Iron Solution & App Connect Professional is affected by Open Source vulnerabilities
Summary IBM WebSphere Cast Iron Solution & App Connect Professional has addressed the open source vulnerabilities. Vulnerability Details CVEID: CVE-2019-9824 DESCRIPTION: tcpemu in slirp/tcpsubr.c aka slirp/src/tcpsubr.c in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to...
CVE-2019-6032
The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Information disclosure
The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2019-6032
The CVE-2019-6032 entry affects the Android App “NTV News24” prior to Ver.3.0.0, which fails to verify SSL server certificates (CWE-295). This enables a MITM attacker to spoof servers and eavesdrop or obtain sensitive data. Affected: NTV News24 Android app (prior to 3.0.0). Root cause: improper c...
IBM Financial Transaction Manager for SWIFT Services Cross-Site Scripting Vulnerability
IBM Financial Transaction Manager for SWIFT Services is a financial transaction manager product from IBM, USA. The product is primarily used for monitoring, tracking and reporting financial payments and transactions. A cross-site scripting vulnerability exists in IBM Financial Transaction Manager...
IBM Financial Transaction Manager for SWIFT Services Cross-Site Request Forgery Vulnerability
IBM Financial Transaction Manager for SWIFT Services is a financial transaction manager product from IBM, USA. The product is primarily used for monitoring, tracking and reporting financial payments and transactions. A cross-site request forgery vulnerability exists in IBM Financial Transaction...
JVN#01236065: Android App "NTV News24" fails to verify SSL server certificates
Android App "NTV News24" provided by Nippon Television Network Corporation fails to verify SSL server certificates CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to th...
DEBIAN-CVE-2018-1311
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...
UBUNTU-CVE-2019-19553
In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection...
Design/Logic Flaw
Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging...
GHSA-6XC2-MJ39-Q599 Strapi allows unauthenticated attacker to reset admin password without valid reset token
Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. Recommendation Upgrade to version 3.0.0-beta.17.5 or later...
McAfee Client Proxy Authentication Bypass Vulnerability
McAfee Client Proxy MCP is a client proxy program in the McAfee Web Protection web security solution from McAfee, Inc. An authentication bypass vulnerability exists in McAfee MCP versions prior to 3.0.0 Windows. An attacker could exploit this vulnerability to bypass network traffic scans and acce...
user/group information can be corrupted across storing in fsimage and reading back from fsimage
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage...
CVE-2019-17608
HongCMS 3.0.0 has XSS via the install/index.php dbname parameter...
CVE-2019-17609
HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter...
CVE-2019-17610
HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter...
Design/Logic Flaw
HongCMS 3.0.0 has XSS via the install/index.php servername parameter...
Design/Logic Flaw
HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter...
