CVE-2019-20436: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configurin...

CVE-2019-20437: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as t...

Exploit for CVE-2020-0609

This is a PoC exploit for CVE-2020-0609 and CVE-2020-0610, two v...

Cookies, Single Sign-On, and You

What's the problem? As part of a concerted effort to protect end user privacy and increase browser security, major web browsers have been making changes to their treatment of 3rd party cookies. These changes are designed to cripple ad targeting services that track user behavior online and rely on...

CVE-2019-10956

Geutebruck IP Cameras G-CodeEEC-2xxx, G-CamEBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx: All versions 1.12.0.25 and prior may allow a remote authenticated user, using a specially crafted URL command, to execute commands as root...

IR & Forensics in the Cloud

More and more organisations are moving their business to the cloud. This makes securing data and being able to respond effectively to incidents in cloud environments an important topic. Having the skills on hand to properly collect digital forensics data in response to a legal dispute or during a...

PT-2020-15043 · Otrs +2 · Otrs Community Edition +2

Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 5.0.39 and prior versions OTRS Community Edition versions 6.0.24 and prior versions OTRS Community Edition versions 7.0.13 and prior versions Description: The issue arises from improper handling of uploaded...

Red Hat JBoss EAP and JBoss Application Server Privilege Vulnerability

Red Hat JBoss Application Server is a U.S. Red Hat Red Hat company based on Java EE open source application server. The product has a startup ultra-fast , lightweight , modular design , hot and parallel deployment , simple management , domain management and the first class components and other...

CVE-2019-20043

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this...

Design/Logic Flaw

An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "discover ZigBee network procedure" to perform a denial of service attack...

PT-2019-14464

Name of the Vulnerable Software and Affected Versions ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices affected versions not specified Description An issue was discovered that allows attackers to perform a denial of service attack by utilizing the "discover ZigBee network...

CVE-2019-15910: Improper Input Validation

An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "discover ZigBee network procedure" to perform a denial of service attack...

PT-2019-14466

Name of the Vulnerable Software and Affected Versions ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices affected versions not specified Description An issue was discovered that allows attackers to perform multiple denial of service attacks using the ZigBee trust center rejoin...

CVE-2019-15911: Cleartext Transmission of Sensitive Information

An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee communication, attackers can obtain sensitive information, cause the multiple denial of service attacks, take over smart home devices, and...

PT-2019-14465

Name of the Vulnerable Software and Affected Versions ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices affected versions not specified Description The issue is related to insecure key transport in ZigBee communication, allowing attackers to obtain sensitive information, cause...

CVE-2019-19141

The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as on a default Ubuntu installation...

Input validation

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

CVE-2012-2312

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

CVE-2012-2312

CVE-2012-2312 affects JBoss AS 7 Community Release. The issue arises from improper security context propagation: a thread-pool-reused security context may retain the previous process’s context, enabling a local user to obtain elevated privileges. The connected documents corroborate the elevated-p...

CVE-2012-2312

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...