620 matches found
QEMU 'ide_dma_cb()' function denial of service vulnerability
QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A security vulnerability exists in the 'idedmacb' function in the hw/ide/core.c file in QEMU versions 2.4.0 through 4.2.0. An...
NopCommerce 4.2.0 - Privilege Escalation
NopCommerce 4.2.0 - Privilege Escalation Vulnerability Title: NopCommerce 4.2.0 - Privilege Escalation Author: Alessandro Magnosi d3adc0de Date: 2019-07-07 Vendor Homepage: https://www.nopcommerce.com/ Software Link : https://www.nopcommerce.com/ Tested Version: 4.2.0 Vulnerability Type: Privileg...
nopCommerce Elevation of Privilege Vulnerability
nopCommerce is an open source e-commerce shopping cart software. nopCommerce 4.2.0 suffers from an elevation of privilege vulnerability that can be exploited by an attacker with the help of a specially crafted Facebook Auth plugin...
PowerDNS Authoritative Server 4.x < 4.2.0 DoS Vulnerability
PowerDNS Authoritative Server is prone to a denial of service DoS vulnerability when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...
Sensio Labs Symfony Information Disclosure Vulnerability
Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . An information disclosure vulnerability exists in Sensio...
UBUNTU-CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache...
PT-2019-14702 · Jenkins · Jenkins Google Compute Engine Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier Description: The issue is related to missing permission checks in various API endpoints, allowing attackers with Overall/Read permission to obtain limited information about the...
PT-2019-14701 · Jenkins · Jenkins Google Compute Engine Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier Description: The issue allows man-in-the-middle attacks due to the lack of SSH host key verification when connecting agents created by the plugin. This enables potential attacker...
CVE-2019-18886: Prevent user enumeration using switch user functionality
Affected versions Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7 versions of the Symfony Security/Http component are affected by this security issue. The issue has been fixed in Symfony 4.2.12 and 4.3.8. Note that no fixes are provided for Symfony 4.1 as they are not maintained anymore. Description T...
CVE-2019-17332 TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting Vulnerabilities
The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and...
WiKID Systems 2FA Enterprise Server SQL Injection Vulnerability
WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A SQL injection vulnerability exists in the processPref.jsp file in WiKID 2FA Enterprise Server 4.2.0-b2053 and prior versions. The vulnerability stems from a database-based application that lacks...
WiKID Systems 2FA Enterprise Server Cross-Site Scripting Vulnerability
WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A cross-site scripting vulnerability exists in WiKID 2FA Enterprise Server 4.2.0-b2047 and prior versions. The vulnerability stems from a WEB application lacking proper authentication of client data...
CVE-2019-17114
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...
CVE-2019-17118
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...
CVE-2018-5732
Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server or an entity masquerading as a server to cause a buffer overflow and resulting crash in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions...
CVE-2019-17179
4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1...
CVE-2016-10866
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues...
nsd -- Stack-based Buffer Overflow
Frederic Cambus reports: nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dnameconcatenate function in dname.c...
