Optergy 2.3.0a - Remote Code Execution (Backdoor)

Optergy 2.3.0a - Remote Code Execution Backdoor Title: Optergy 2.3.0a - Remote Code Execution Author: LiquidWorm Date: 2019-11-05 Vendor: https://optergy.com/ Product web page: https://optergy.com/products/ Affected version: \n' sys.exit while True: challengeurl =...

chromium-browser: Bypass on download restrictions

Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML page...

PT-2019-17027 · Ibm · Ibm Security Guardium Big Data Intelligence

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Big Data Intelligence SonarG version 4.0 Description: The issue specifies permissions for a security-critical resource, which could lead to the exposure of sensitive information or the modification of that resource by...

vBulletin < 5.5.4 Clickjacking Vulnerability

vBulletin is prone to a clickjacking vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vbulletin:vbulletin";...

CVE-2019-2959

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion component: Security Models. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Financial Reporting...

PT-2019-7738 · Pagelines +1 · Pagelines +1

Name of the Vulnerable Software and Affected Versions: PageLines theme version 1.1.4 Description: The issue concerns a CSRF vulnerability in the PageLines theme for WordPress. It affects the "wp-admin/admin-post.php?page=pagelines" endpoint. Recommendations: For PageLines theme version 1.1.4,...

OpenSC out-of-bounds access vulnerability (CNVD-2019-31367)

OpenSC is a set of software tools and libraries for smart cards, focusing on smart cards with cryptographic capabilities. An ASN.1 Bitstring out-of-bounds access vulnerability exists in decodebitstring in libopensc/asn1.c in versions prior to OpenSC 0.20.0-rc1. No detailed vulnerability details a...

Exim < 4.92.2 RCE Vulnerability

Exim is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:exim:exim"; if...

PT-2019-14499 · Foxtan +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: Xpdf version 3.04 Description: The issue occurs due to a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc. Recommendations: For Xpdf version 3.04, at the moment, there is no information abou...

WordPress Icegram Plugin < 1.10.29 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113498";...

Escalation of Privilege in Twistlock

An HTML injection vulnerability has been identified in the Twistlock Console that can lead to a DOM based XSS attack under certain configurations. Ref , CVE-2019-1583 Successful exploitation of this vulnerability allows a Twistlock user with Operator capabilities to escalate privileges to that of...

PT-2019-14015 · Adplug Team · Adplug

Name of the Vulnerable Software and Affected Versions: AdPlug version 2.3.1 Description: The issue is related to a double free in the Cu6mPlayer class located in u6m.h. Recommendations: For AdPlug version 2.3.1, at the moment, there is no information about a newer version that contains a fix for...

mysql: Server: Connection unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2016-10797

cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains SEC-133...

CVE-2019-14417

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to DNS functionality...

PT-2020-3606 · Saltstack +3 · Saltstack Salt +3

Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 2019.2.4 SaltStack Salt versions 3000 prior to 3000.2 Description: An issue was discovered in the salt-master process ClearFuncs class, which does not properly validate method calls. This allows a remote user ...

CVE-2019-2569

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Difficult to exploit vulnerability allows high privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes...

Exploit for Injection in Atlassian Jira_Server

CVE-2019-11581 Atlassian JIRA Template injection vulnerabil...

PT-2019-12508 · Synology · Synology Photo Station

Name of the Vulnerable Software and Affected Versions: Synology Photo Station versions prior to 6.8.11-3489 Synology Photo Station versions prior to 6.3-2977 Description: The issue allows remote attackers to execute arbitrary SQL commands via the type parameter in the synophoto csPhotoDB.php file...

Foxit Reader < 9.3 Multiple Vulnerabilities (Jun 2019) - Windows

Foxit Reader is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:reader";...