CVE-2019-17306

SugarCRM versions affected:

CVE-2019-17314

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user...

CVE-2019-17314: Improper Limitation of a Pathname to a Restricted Directory

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user...

CVE-2019-17306: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user...

PT-2019-11763 · Jenkins · Jenkins Configuration As Code Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Configuration as Code Plugin versions 1.26 and earlier Description: The issue arises from an incomplete fix that did not properly apply masking to some values expected to be hidden when logging the configuration being applied. This...

Schneider PMEPXM0100 ProSoft Configurator suffers from dll hijacking vulnerability

Schneider Electric SA is a global electrical company headquartered in France and a global specialist in energy efficiency management and automation. A dll hijacking vulnerability exists in Schneider PMEPXM0100 ProSoft Configurator, which can be exploited by an attacker to gain server privileges...

CVE-2019-10976

Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file .frc2. Once a user opens the file, the attacker could read arbitrary files...

Mitsubishi FR Configurator2 Code Issue Vulnerability

Mitsubishi FR Configurator2 is an inverter drive configuration application from Mitsubishi Electric Japan. A code issue vulnerability exists in Mitsubishi FR Configurator2 that stems from the program not filtering input passed to the XML parser. An attacker could exploit the vulnerability to read...

Design/Logic Flaw

The application Network Configurator for DeviceNet Safety 3.41 and prior searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories...

CVE-2019-10971

The application Network Configurator for DeviceNet Safety 3.41 and prior searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories...

CVE-2019-10971

CVE-2019-10971 affects the Network Configurator for DeviceNet Safety, version 3.41 and prior. The vulnerability arises from an untrusted search path that could cause the application to execute a malicious DLL outside its intended directories. Impact: potential arbitrary code execution with the ap...

CVE-2019-10971

The application Network Configurator for DeviceNet Safety 3.41 and prior searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories...

CVE-2019-10971: Untrusted Search Path

The application Network Configurator for DeviceNet Safety 3.41 and prior searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories...

schneider MSX Configurator suffers from dll hijacking vulnerability

Schneider Electric SA is a global electrical company headquartered in France and a global specialist in energy efficiency management and automation. A dll hijacking vulnerability exists in schneider MSX Configurator. An attacker can exploit this vulnerability to load a malicious dll and execute...

CVE-2019-2567

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite subcomponent: Active Model Generation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

CVE-2019-2567

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite subcomponent: Active Model Generation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

Design/Logic Flaw

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite subcomponent: Active Model Generation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

CVE-2019-2567

CVE-2019-2567 affects Oracle Configurator (Active Model Generation) in Oracle Supply Chain Products Suite. Affected: 12.1 and 12.2. Issue: unauthenticated attacker over HTTP can gain unauthorized access to Oracle Configurator data. CVSSv3 base score 7.5 (High) with confidentiality impact. Connect...

CVE-2019-2567

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite subcomponent: Active Model Generation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

CVE-2019-2567: Undefined Security Weakness

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite subcomponent: Active Model Generation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...