WordPress wp-support-plus-responsive-ticket-system plugin authorization issue vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-support-plus-responsive-ticket-system is a ticket system plugin used in it. An authorization issue vulnerability exists in WordPres...

Fuji Electric Alpha5 Smart Loader

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Fuji Electric Equipment: Alpha5 Smart Loader Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute code under the privileges of...

CVE-2019-0346

The CVE-2019-0346 entry concerns SAP Business Objects Business Intelligence Platform (Central Management Console) v4.2, where an unencrypted communication error can disclose the list of user names and roles imported from SAP NetWeaver BI systems. The affected component is the Central Management C...

CVE-2019-0334

CVE-2019-0334 affects SAP BusinessObjects BI Platform (BI Workspace) versions 4.1, 4.2, and 4.3. The issue allows storing a malicious script during module creation, which, when executed, could enable a user to escalate privileges through session hijacking and expose sensitive information via Stor...

CVE-2019-0335

SAP BusinessObjects BI Platform Central Management Console (versions 4.1–4.3) is affected by a stored XSS in the user description field. An attacker can store a payload in a user’s description that executes when the mouse hovers over the description in the UI’s info popup. The available documents...

CVE-2019-0332

CVE-2019-0332 affects SAP BusinessObjects BI Platform (Info View), versions 4.1, 4.2, and 4.3. The vulnerability allows an attacker to supply a payload as a search keyword, which is executed during the search action, resulting in Cross-Site Scripting (XSS). Root cause: inadequate input handling i...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2019-25982)

SAP BusinessObjects Business Intelligence Platform is a suite of bookstore intelligence software and enterprise performance solutions from Germany's SAP. The product features report generation, analytics and data visualization. A cross-site scripting vulnerability exists in SAP BusinessObjects...

CVE-2019-2797

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached ...

CVE-2019-3570

Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are configurable by an attacker for instance by providing the output of scryptenc in a context where Hack/PHP code would attempt to verify it by...

CVE-2019-0329

SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0329

SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0329

CVE-2019-0329 affects SAP Information Steward, version 4.2, with a Cross-Site Scripting (XSS) vulnerability caused by insufficient encoding of user-controlled inputs in the WEB application. This leads to potential execution of client-side code. No remediation details are provided in the connected...

Information disclosure

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versio...

Pivotal Software Spring Security Authentication Vulnerability

Pivotal Software Spring Security is a suite of security frameworks from Pivotal Software, Inc. that provide illustrative security protection for Spring-based applications. A security vulnerability exists in Pivotal Software Spring Security versions 4.2.x through 4.2.12 and older versions that are...

MongoDB 4.2 Introduces End-to-End Field Level Encryption for Databases

At its developer conference held earlier this week in New York, the MongoDB team announced the latest version of its database management software that includes a variety of advanced features, including Field Level Encryption, Distributed Transactions, and Wildcard Indexes. The newly introduced...

PlaintextPasswordEncoder authenticates encoded passwords that are null

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

Sql injection

admin/Lib/Action/FpluginAction.class.php in FDCMS aka Fangfa Content Manage System 4.2 allows SQL Injection...

Axessh 4.2 - Log file name Denial of Service (PoC)

Axessh 4.2 - Log file name Denial of Service PoC Exploit Title: Axessh 4.2 'Log file name' - Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-05-14 Vendor Homepage: http://www.labf.com Software Link: http://www.labf.com/download/axessh.exe Tested Version: 4.2 Tested on:...

Axessh 4.2 Denial Of Service

Exploit Title: Axessh 4.2 'Log file name' - Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-05-14 Vendor Homepage: http://www.labf.com Software Link: http://www.labf.com/download/axessh.exe Tested Version: 4.2 Tested on: Windows 7 Service Pack 1 x32 Steps to produce the...