463 matches found
CVE-2019-1020013
parse-server before 3.6.0 allows account enumeration...
CVE-2019-1020013
parse-server before 3.6.0 allows account enumeration...
GHSA-8W3J-G983-8JH5 Sensitive Data Exposure in parse-server
Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...
AZL-38326 CVE-2019-8457 affecting package ceph for versions less than 18.2.1-1
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode function when handling invalid rtree tables...
CVE-2019-4207
IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks against the system. IBM X-Force ID: 159148...
Information disclosure
IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks against the system. IBM X-Force ID: 159148...
CVE-2019-4207
IBM TRIRIGA Application Platform vulnerable in versions 3.5.3 and 3.6.0 to an information disclosure that could be exploited by a local user to access sensitive data. The issue is addressed by fixes: 3.5.3.6 and 3.6.0.3. (Exploitation status not described in the provided documents.)
PT-2019-16965 · Ibm · Ibm Tririga Application Platform
Name of the Vulnerable Software and Affected Versions: IBM TRIRIGA Application Platform versions 3.5.3 through 3.6.0 Description: The issue allows a remote attacker to exploit an XML External Entity Injection XXE attack when processing XML data, potentially exposing sensitive information or...
PT-2019-16964 · Ibm · Ibm Tririga Application Platform
Name of the Vulnerable Software and Affected Versions: IBM TRIRIGA Application Platform versions 3.5.3 through 3.6.0 Description: The issue may disclose sensitive information that is only available to a local user, which could be used in further attacks against the system. Recommendations: For...
IBM TRIRIGA Application Platform Information Disclosure Vulnerability (CNVD-2019-13258)
The IBM TRIRIGA Application Platform is a set of technology platforms for deploying TRIRIGA applications from IBM in the United States. The platform provides a set of design-time and run-time components for building and running its enterprise applications, respectively, and supports...
Moodle CMS 3.6.x <= 3.6.2 Authentication Bypass Vulnerability
Moodle CMS is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...
PT-2019-5513 · Mongodb +1 · Mongodb Server +2
Name of the Vulnerable Software and Affected Versions: MongoDB Server versions 3.6.0 through 3.6.17 MongoDB Server versions 4.0.0 through 4.0.14 MongoDB Server versions 4.2.0 through 4.2.2 MongoDB Server versions 4.3.0 through 4.3.2 Description: The issue is related to improper serialization of...
Code injection
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...
CVE-2018-11720
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal...
CVE-2018-11719
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE...
CVE-2018-11718
Xovis PC2, PC2R and PC3 devices (firmware up to 3.6.0) are affected by a CSRF vulnerability. The connected CNVD entry explicitly describes a cross-site request forgery path impacting these sensors; no exploitation details, impact quantification, or official remediation/version fixes are provided ...
PT-2018-9622 · Apache +3 · Plexis Archiver +3
Name of the Vulnerable Software and Affected Versions: plexus-archiver versions prior to 3.6.0 Description: The issue allows attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This is also known as 'Zip-Slip'. Recommendations: F...
CVE-2018-12085
Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440...