Cisco Emergency Responder CVE-2019-16025 HTML Injection Vulnerability

Description Cisco Emergency Responder is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to...

PT-2020-11216

Name of the Vulnerable Software and Affected Versions Modicon M580 affected versions not specified Modicon M340 affected versions not specified Modicon Quantum affected versions not specified Modicon Premium affected versions not specified Description A vulnerability exists that could cause a...

PT-2020-18492 · Gila · Gila Cms

Name of the Vulnerable Software and Affected Versions: Gila CMS version 1.11.8 Description: The issue allows for SQL Injection through the /admin/sql endpoint with a query parameter. This can potentially lead to unauthorized access or manipulation of database content. Recommendations: For Gila CM...

Cisco Data Center Network Manager XML External Entity Information Disclosure Vulnerability

Description Cisco Data Center Network Manager is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. This issue is being tracked by Cisco bug IDs CSCvr79188, CSCvr88730 and CSCvr88737. Cisco...

Cisco Data Center Network Manager Multiple Authentication Bypass Vulnerabilities

Description Cisco Data Center Network Manager is prone to multiple authentication-bypass vulnerabilities. An attacker can exploit these issues to bypass authentication mechanism and perform unauthorized actions with administrative privileges. This may lead to further attacks. These issues are bei...

GitLab Multiple Security Vulnerabilities

Description GitLab is prone to multiple security vulnerabilities. An attacker can exploit these issues to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. GitLab versions prior to 11.4.13, 11.5.x prior to 11.5.6, and 11.6.x prior to 11.6.1 are...

PT-2019-16107 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC versions 0.8.0 through 0.9.0-development-20191109 Description: A heap-based buffer overflow issue exists in the function gf isom box parse ex located in isomedia/box funcs.c. Recommendations: For GPAC version 0.8.0, update to a version...

MyBB CVE-2019-20225 Open Redirection Vulnerability

Description MyBB is prone to an open-redirection vulnerability. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks...

CVE-2019-6023

Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to bypass access restriction which may result in obtaining data without access privileges via the application 'Address'...

WordPress bbPress Members Only Plugin Cross Site Request Forgery Vulnerability

Description The 'bbPress Members Only' Plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. The 'bbPress Members Only'...

CVE-2019-19151

On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell tmsh privileges are able access object...

SQLite CVE-2019-19926 Incomplete Fix Denial of Service Vulnerability

Description SQLite is prone to a denial of service vulnerability. Attackers can exploit this issue to cause denial-of-service conditions. SQLite 3.30.1 is vulnerable; other versions may also be affected. Technologies Affected SQLite SQLite 3.30.1 Recommendations Block external access at the netwo...

PT-2019-6233 · Waitress +3 · Waitress +3

Name of the Vulnerable Software and Affected Versions: Waitress versions 1.3.1 and earlier Description: The issue is related to the incorrect handling of repeated Content-Length headers in Waitress, allowing request smuggling. If two Content-Length headers are sent in a single request, Waitress...

PT-2019-4664 · Todd Miller +4 · Sudo +4

Name of the Vulnerable Software and Affected Versions: Sudo versions 1.8.29 and earlier Description: The issue is related to the sudoer account with Runas ALL privileges, allowing an attacker to impersonate a nonexistent user by invoking sudo with a numeric uid not associated with any user. This...

Multiple Moxa Products CVE-2019-19707 Denial of Service Vulnerability

Description Multiple Moxa Products are prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause resource exhaustion to the affected device, denying service to legitimate users. Technologies Affected Moxa EDS-G508E Series 6 Moxa EDS-G512E Series 6 Moxa EDS-G51...

CVE-2019-8698

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in iOS 12.4, tvOS 12.4. A malicious application may be able to restrict access to websites...

CVE-2019-8598

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A malicious application may be able to read restricted memory...

Information disclosure

The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 13. A person with physical access to an iOS device may be able to access contacts from the lock screen...

Input validation

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in iOS 12.4, tvOS 12.4. A malicious application may be able to restrict access to websites...

MTN Group: SharePoint exposed web services in a subdomain

Hi there I found a subdomain that is sharepoint configuration is poorly implemented Because of improper configuration an anonymous user can access to the SharePoint Web Services. POC: Go to the following url: https://www.mtn.co.za/vtibin/lists.asmx?WSDL services.jpg Remediation Restrict access to...