PT-2020-12685

Name of the Vulnerable Software and Affected Versions NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite SRS60 version 2.5.1.106 NETGEAR Outdoor Satellite RBS50Y version 2.5.1.106 NETGEAR Pro Tri-Band Business WiFi Router SRR60 version 2.5.1.106 Description An issue allows an unauthenticated...

CVE-2020-11551: Improper Authentication

An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite SRS60 AC3000 V2.5.1.106, Outdoor Satellite RBS50Y V2.5.1.106, and Pro Tri-Band Business WiFi Router SRR60 AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote write of arbitrary Wi-Fi...

CVE-2020-11549: Use of Hard-coded Credentials

An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite SRS60 AC3000 V2.5.1.106, Outdoor Satellite RBS50Y V2.5.1.106, and Pro Tri-Band Business WiFi Router SRR60 AC3000 V2.5.1.106. The root account has the same password as the Web-admin component. Thus, by exploiting...

PT-2020-5396

Name of the Vulnerable Software and Affected Versions NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite SRS60 version 2.5.1.106 NETGEAR Outdoor Satellite RBS50Y version 2.5.1.106 NETGEAR Pro Tri-Band Business WiFi Router SRR60 AC3000 version 2.5.1.106 Description The issue is related to the us...

Improper access control

Improper Access Control in PALLET CONTROL Ver. 6.3 and earlier allows authenticated attackers to execute arbitrary code with the SYSTEM privilege on the computer where PALLET CONTROL is installed via unspecified vectors. PalletControl 7 to 9.1 are not affected by this vulnerability, however under...

JVN#61849442: PALLET CONTROL vulnerable to arbitrary code execution

PALLET CONTROL provided by JAL Information Technology Co., Ltd. is IT asset management software. PALLET CONTROL contains an arbitrary code execution vulnerability due to improper file access permission CWE-284. Impact A user who can login to the computer where the vulnerable product is installed...

PT-2020-18513

Name of the Vulnerable Software and Affected Versions PALLET CONTROL versions 6.3 and earlier PALLET CONTROL all versions when used with PLS Management Add-on Module Description The issue allows authenticated attackers to execute arbitrary code with the SYSTEM privilege on the computer where the...

CVE-2020-5538: Undefined Security Weakness

Improper Access Control in PALLET CONTROL Ver. 6.3 and earlier allows authenticated attackers to execute arbitrary code with the SYSTEM privilege on the computer where PALLET CONTROL is installed via unspecified vectors. PalletControl 7 to 9.1 are not affected by this vulnerability, however under...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. It was found that the fix for CVE-2010-0179 was incomplete when the Firebug add-on was used. If a user visited a website containing malicious JavaScript while the Firebug add-on was enabled, it could cause Firefox to execute arbitrary JavaScript...

Privilege Escalation

firefox is vulnerable to privilege escalation. The vulnerability exists when the Firebug add-on is in use. The XMLHttpRequestSpy module in the Firebug add-on exposes a Chrome privilege escalation flaw that could be used to execute arbitrary JavaScript with the privileges of the user running Firef...

Huawei EulerOS: Security Advisory for firefox (EulerOS-SA-2016-1085)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

TIBCO EBX Add-on CVE-2019-17331 Cross Site Scripting Vulnerability

Description TIBCO EBX Add-on is prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let t...

TIBCO EBX Add-on CVE-2019-17332 Cross Site Scripting Vulnerability

Description TIBCO EBX Add-on is prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let t...

TIBCO Security Advisory: November 12, 2019 - TIBCO EBX Add-on -2019-17332

TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting Vulnerabilities Original release date: November 12,2019 Last revised: CVE-2019-17332 Source: TIBCO Software Inc. TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting Vulnerabilities Original release date: November 12, 2019...

TIBCO Security Advisory: November 12, 2019 - TIBCO EBX Add-on -2019-17331

TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities Original release date: November 12,2019 Last revised: CVE-2019-17331 Source: TIBCO Software Inc. TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities Original release date: November 12, 2019 Last revised: -...

WordPress YITH WooCommerce Brands Add-On plugin <=1.3.6 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Brands Add-On plugin versions =1.3.6. Solution Update the WordPress YITH WooCommerce Brands Add-On plugin to the latest available version at least 1.3.7...

CVE-2019-0379

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle BC, leading to Missing Authentication Check...

CVE-2019-0379

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle BC, leading to Missing Authentication Check...

CVE-2019-0379: Missing Authentication for Critical Function

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle BC, leading to Missing Authentication Check...

CVE-2019-3747: Improper Neutralization of Input During Web Page Generation

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users...