CVE-2019-1934

A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to elevate privileges and execute administrative functions on an affected device. The vulnerability is due to insufficient authorization validation...

USN-4089-1 ruby-rack vulnerability

It was discovered that Rack incorrectly handled carefully crafted requests. A remote attacker could use this issue to execute a cross-site scripting XSS attack...

PT-2019-3172 · Cisco · Cisco Ftd

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the Secure Sockets Layer SSL/Transport Layer Security TLS protocol inspection engine could allow an unauthenticated, remote attacker t...

nodejs: HTTP parser allowed for spaces inside Content-Length header values

It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior...

cPanel Information Disclosure Vulnerability (CNVD-2019-26344)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An information disclosure vulnerability exists in versions prior to cPanel 64.0.21. The vulnerability can be exploited by an...

VulnCheck KEV: CVE-2019-0708

Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The...

nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass

It was found that the original fix for Slowloris, CVE-2018-12122, was insufficient. It is possible to bypass the server's headersTimeout by sending two specially crafted HTTP requests in the same connection. An attacker could use this flaw to bypass Slowloris protection, resulting in a denial of...

The vulnerability of the mod_http2 module in the Apache HTTP Server allows a attacker to cause a service failure or gain access to confidential information.

The vulnerability of the modhttp2 module in the Apache HTTP Server is related to the use of memory after deallocation. Exploiting this vulnerability can allow a malicious actor to cause service failures or gain access to confidential information by sending specially crafted requests...

CVE-2019-1134

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'...

Microsoft Exchange Server Cross-Site Scripting Vulnerability (CNVD-2019-22224)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A cross-site scripting vulnerability exists in Microsoft Exchange Server, which stems from the...

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

Advantech WebAccess webvprcs IOCTL 10012 Stack Overflow

Binary data scadaadvantechwebaccesscve-2019-3953.nbin...

CVE-2019-4087

IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by servers and storage agents in response to specifically crafted communication exchanges. By sending an overly long request, a remote attacker could...

The vulnerability of the software-defined Cisco SD-WAN web interface, related to authentication process errors, allows a perpetrator to escalate their privileges.

The vulnerability of the software-defined Cisco SD-WAN Web UI is related to authentication process errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges by sending specially crafted HTTP requests...

CVE-2019-4382

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...

CVE-2018-2011

IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150...

PT-2019-17050 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows an unauthorized user to obtain sensitive information about system users by using specially crafted HTTP requests. Recommendations: For versions 5.0.0.0 through...

The vulnerability of the SMC-processor GLOBAL_CMD_ID_NEED_LOAD_APP in the TEE OS Trusted Core of the Huawei Mate 9 Pro mobile phone operating system allows a perpetrator to trigger a service failure, modify program algorithms (by changing the flags from TRUE/FALSE), or compromise critical data stored in physical memory.

The vulnerability of the SMC-processor GLOBALCMDIDNEEDLOADAPP in the TEE OS Trusted Core of the Huawei Mate 9 Pro mobile phone operating system is related to the lack of validation for input data. Exploiting this vulnerability can allow an attacker to cause service failures, modify program...

The vulnerability in the web interface of the Cisco Industrial Network Director software allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Cisco Industrial Network Director software’s web interface exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by sending specially crafted requests...

The vulnerability of the ASP.NET Core software platform, related to errors in request processing, allows a hacker to cause a service failure.

The vulnerability of the ASP.NET Core software platform is related to errors in request processing. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted requests to the ASP.NET Core application...