CVE-2019-15997

CVE-2019-15997 affects Cisco DNA Spaces: Connector. The advisory and multiple sources describe a local command-injection vulnerability caused by insufficient validation of CLI command arguments. An authenticated, local attacker could supply malicious input during command execution and gain arbitr...

CVE-2019-15997 Cisco DNA Spaces: Connector Command Injection Vulnerability

A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI...

CVE-2019-15997: Improper Input Validation

A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI...

CVE-2019-15995: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicio...

CVE-2019-15996: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An...

Cisco DNA Spaces:Connector Privilege Permission and Access Control Issues Vulnerability

Cisco DNA Spaces is a set of indoor location services platform from Cisco.Cisco DNA Spaces:Connector is one of the connectors used to support the communication of Cisco wireless controllers. A Privilege Permission and Access Control Error vulnerability exists in versions prior to Cisco DNA Spaces...

Cisco DNA Spaces:Connector Input Validation Error Vulnerability

Cisco DNA Spaces is a set of indoor location services platform from Cisco.Cisco DNA Spaces:Connector is one of the connectors used to support the communication of Cisco wireless controllers. An input validation error vulnerability exists in versions prior to Cisco DNA Spaces: Connector 2.0, which...

Cisco DNA Spaces:Connector SQL Injection Vulnerability

Cisco DNA Spaces is a set of indoor location services platform from Cisco.Cisco DNA Spaces:Connector is one of the connectors used to support the communication of Cisco wireless controllers. A SQL injection vulnerability exists in the Web UI in versions prior to Cisco DNA Spaces: Connector 2.0 th...

Cisco DNA Spaces: Connector Command Injection Vulnerability

A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI...

Cisco DNA Spaces: Connector Privilege Escalation Vulnerability

A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An...

Cisco DNA Spaces: Connector SQL Injection Vulnerability

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicio...

PT-2019-4240

Name of the Vulnerable Software and Affected Versions Cisco DNA Spaces: Connector affected versions not specified Cisco Digital Network Architecture DNA Center affected versions not specified Description The issue is related to insufficient validation of input data, which could allow an...

PT-2019-4241

Name of the Vulnerable Software and Affected Versions Cisco DNA Spaces: Connector affected versions not specified Cisco Digital Network Architecture DNA Center affected versions not specified Description The issue is related to insufficient restrictions during the execution of a CLI command,...

PT-2019-4242

Name of the Vulnerable Software and Affected Versions Cisco DNA Center versions affected versions not specified Cisco DNA Spaces: Connector versions affected versions not specified Description The issue is related to the lack of protection against SQL query structure attacks in the web interface ...

Xxe

Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious...

The vulnerability of the Connector/ODBC sub-component of the MySQL Connectors component of the database management system MySQL allows a attacker to cause a service failure.

The vulnerability of the Connector/ODBC sub-component of the MySQL Connectors database management system is related to incorrect authentication. Exploiting this vulnerability allows a malicious actor to cause service failures using the MySQL network protocol...

Linux kernel memory leak vulnerability (CNVD-2019-40151)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory leak vulnerability exists in the komedawbconnectoradd function in...

UBUNTU-CVE-2019-18810

A memory leak in the komedawbconnectoradd function in drivers/gpu/drm/arm/display/komeda/komedawbconnector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service memory consumption by triggering drmwritebackconnectorinit failures, aka CID-a0ecd6fdbf5d...

Magento Server-Side Request Forgery Vulnerability

Magento is an open source PHP e-commerce system from the U.S. company Magento. Magento has a server-side request forgery vulnerability. An attacker can exploit this vulnerability to manipulate the connector api endpoints to achieve remote code execution...

CVE-2019-8156: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution...