9720 matches found
Information disclosure
The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store,...
[SECURITY] Fedora 30 Update: at-spi2-core-2.32.1-2.fc30
at-spi allows assistive technologies to access GTK-based applications. Essentially it exposes the internals of applications for automation, so tools such as screen readers, magnifiers, or even scripting interfaces can query and interact with GUI controls. This version of at-spi is a major break...
Cisco RV325 < 1.4.2.22 Multiple Vulnerabilities
Binary data 700567.prm...
PT-2019-1936
Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology versions 8.5.3 through 8.5.4 Description The issue is related to insufficient access controls in the Outside In Filters subcomponent of Oracle Outside In Technology, a suite of software development kits SDKs. This...
PT-2019-1939
Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology versions 8.5.3 through 8.5.4 Description The issue is related to insufficient access controls in the Oracle Outside In Technology component, specifically the Outside In Filters subcomponent. This allows an...
Cisco RV320 < 1.4.2.22 Multiple Vulnerabilities
Binary data 700566.prm...
PT-2019-1925
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3, 12.2.3 through 12.2.8 Description The issue is related to insufficient access controls in the Renewals subcomponent of Oracle Service Contracts, part of the Oracle E-Business Suite system...
PT-2019-1935
Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology versions 8.5.3 through 8.5.4 Description The issue is related to insufficient access controls in the Outside In Filters subcomponent of Oracle Outside In Technology, a suite of software development kits SDKs. This...
Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)
According to its self-reported version, this Cisco Small Business RV Series router is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker wi...
UBUNTU-CVE-2019-11236
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter...
CVE-2019-9696
Symantec VIP Enterprise Gateway all versions may be susceptible to a cross-site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentiall...
CVE-2018-14894
CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker who is able to edit permissions of a file to bypass intended access restrictions and execute blocked applications...
CVE-2018-19589
Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...
CVE-2018-19589
Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...
CVE-2018-19589
The CVE-2018-19589 describes incorrect access controls in the PKCS11 R2 provider shipping with Utimaco CryptoServer HSM. An SO authenticated to a slot can retrieve attributes of keys marked as private in external key storage and can delete such keys, potentially compromising availability of all e...
CVE-2018-19589: Incorrect Permission Assignment for Critical Resource
Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...
PT-2019-9871
Name of the Vulnerable Software and Affected Versions Utimaco CryptoServer HSM affected versions not specified Description The issue concerns incorrect access controls in the PKCS11 R2 provider of the Utimaco CryptoServer HSM product package. This allows a Security Officer SO authenticated to a...
MyCar Controls uses hard-coded credentials
Overview The MyCar Controls mobile applications prior to v3.4.24 on iOS and prior to v4.1.2 on Android contains hard-coded admin credentials. Description MyCar is a small aftermarket telematics unit from AutoMobility Distribution Inc. MyCar add smartphone-controlled geolocation, remote start/stop...