CVE-2019-20389

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the vlanguageswitch parameter within multipart/form-data, which is reflected back within a user's browser without proper output encoding...

CVE-2020-12641

rcubeimage.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for imconvertpath or imidentifypath...

Race condition

The Synergy Systems & Solutions SSS HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Exceptional Conditions CWE-754 vulnerability. The affected product is vulnerable to specially crafted TCP packets, which can cause the device to shut down or reboot a...

CVE-2019-18677

An issue was discovered in Squid 3.x and 4.x through 4.8 when the appenddomain setting is used because the appended characters do not properly interact with hostname length restrictions. Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be...

Improper access control

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to download the configuration binary file settings by submitting a rom-0 GET request without being authenticated on the admin interface...

CVE-2019-12510

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API "/soap/serversa" by supplying a malicious X-Forwarded-For header of the device's LAN IP address 192.168.1.1 in every request. As a result, an attacker may...

CVE-2019-12510 Auth Bypass Via X-Forwarded-For Header in SOAP API

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API "/soap/serversa" by supplying a malicious X-Forwarded-For header of the device's LAN IP address 192.168.1.1 in every request. As a result, an attacker may...

Security Bulletin: A Security Vulnerability exist in IBM Cognos TM1

Summary A vulnerability has been addressed for PM Hub config exposed via web interface Vulnerability Details CVEID: CVE-2016-0381 DESCRIPTION: IBM TM1 Cognos is vulnerable to a denial of service, caused by an administrator blanking-out a value called "AdminGroups" in the IBM Cognos Performance...

Code injection

An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup...

CVE-2019-8804

CVE-2019-8804 affects Apple iOS/iPadOS Setup Assistant. The issue: an inconsistency in Wi‑Fi network configuration handling during device setup could allow an attacker in physical proximity to redirect a user to a malicious Wi‑Fi network. Root cause is a faulty state/network configuration flow wi...

Duplicate Advisory: Possible remote code execution via a remote procedure call

Withdrawn: duplicate of GHSA-pj4g-4488-wmxm Original Description In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...

CVE-2019-8230

In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path...

Path traversal

In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path...

CVE-2019-14925

CVE-2019-14925 affects Mitsubishi Electric Europe B.V. ME-RTU devices up to v2.02 and INEA ME-RTU devices up to v3.0. The issue is insecure world-readable permissions on /usr/smartrtu/init/settings.xml, allowing access to sensitive configuration data (e.g., usernames and passwords). Public disclo...

Security Bulletin: Vulnerability in Open Source Samba affects IBM Netezza Host Management

Summary Open Source Samba is used by IBM Netezza Host Mangement. IBM Netezza Host Management has provided mitigation for the applicable CVE. Vulnerability Details CVEID: CVE-2019-3880 DESCRIPTION: Samba could allow a remote authenticated attacker to traverse directories on the system. An attacker...

PYSEC-2019-48

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...

High-Severity PrinterLogic Flaws Enable Remote Code Execution

A slew of high-severity flaws have been disclosed in the PrinterLogic printer management service, which could enable a remote attacker to execute code on workstations running the PrinterLogic agent. PrinterLogic’s Print Management software allows businesses to deploy and use remote printers...

PrinterLogic Print Management Software fails to validate SSL certificates or the integrity of software updates.

Overview PrinterLogic Print Management Software fails to validate SSL and software update certificates, which could allow an attacker to reconfigure the software and remotely execute code. In addition, the PrinterLogic agent does not sanitize browser input allowing a remote attacker to modify...

HP LaserJet Printers Authentication Bypass Vulnerability

HP LaserJet Printers could allow a remote attacker to bypass security restrictions, caused by missing authentication for critical function. By sending a specially crafted request, an attacker could exploit this vulnerability to change configuration settings or gain administrative access. Copyrigh...

HP LaserJet P4014/P4015 Printers 6.7.0.x Authentication Bypass

Exploit Title : HP LaserJet P4014/P4015 Printers 6.7.0.x Bypass Missing Authentication Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 31/03/2019 Vendor Homepage : hp.com Software Information Link :...