Magento 2.x Multiple Vulnerabilities (Mar 2019)

Magento 2.x is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:magentocommerce:magento"; if...

FTC Demands Broadband Providers Reveal Data Handling Practices

The Federal Trade Commission FTC is putting pressure on internet broadband providers to reveal exactly what data they’re collecting – and how they are using it. The FTC on Tuesday issued orders to seven U.S. ISPs requesting that they detail how they collect, retain, use and disclose information...

WordPress article2pdf 0.24 DoS / File Deletion / Disclosure Vulnerabilities

WordPress article2pdf plugin versions 0.24 and above suffer from resource exhaustion, arbitrary file download, and file deletion vulnerabilities. Product: article2pdf Wordpress plug-in Product Website: https://wordpress.org/plugins/article2pdf/ Affected Versions: 0.24 and greater The following...

Elastic Logstash Information Disclosure Vulnerability (ESA-2019-05)

Elastic Logstash is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-7612

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message...

CVE-2019-7612

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message...

Design/Logic Flaw

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message...

CVE-2019-7612

CVE-2019-7612 affects Logstash: versions before 5.6.15 and 6.6.1 are vulnerable to a sensitive data disclosure where credentials used in a URL can be logged in error messages due to malformed URL logging. Root cause: improper handling of URL logging in Logstash configuration. Impact: potential ex...

CVE-2019-7612

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message...

The vulnerability of the identification management service of the Cisco Digital Network Architecture (DNA) Center arises from the lack of protective measures for the website structure, allowing attackers to access confidential information.

The vulnerability in the web interface of the management service exists because measures to protect the structure of the web page have not been taken. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential information through a specially...

The vulnerabilities of the functions jio_snprintf and jio_vsnprintf in the Eclipse OpenJ9 virtual machine allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the jiosnprintf and jiovsnprintf functions in the Eclipse OpenJ9 virtual machine is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to trigger buffer overflows and compromise the...

The vulnerabilities of Intel and ARM processors, related to the use of speculative read operations on system registers, allow attackers to exploit these vulnerabilities to disclose protected information.

The vulnerabilities of Intel and ARM processors are related to the use of speculative read operations for system registers. Exploiting these vulnerabilities can allow attackers to disclose system parameters through a specially crafted application...

CVE-2019-6733

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Logstash ESA-2019-05

A sensitive data disclosure flaw was found in the way Logstash logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message. C Tenable Network Security, Inc. include"compat.inc"; ...

Columbia Weather Systems MicroServer

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Columbia Weather Systems, Inc. Equipment: Weather MicroServer Vulnerabilities: Cross-site Scripting, Path Traversal, Improper Authentication, Improper Input Validation, Code Injection 2. RISK...

rdesktop out-of-bounds read vulnerability (CNVD-2019-07806)

rdesktop is an open source UNIX client for connecting to Windows Remote Desktop Services. An out-of-bounds read vulnerability exists in the uicliphandledata function in rdesktop 1.8.3 and earlier versions, which can be exploited by an attacker to obtain information...

Joomla Component XMap Database Leakage Vulnerability

Joomla is an open source content management system CMS. A database disclosure vulnerability exists in the Joomla component XMap. An attacker can exploit the vulnerability to obtain sensitive database information...

GNU LibreDWG Buffer Overflow Vulnerability (CNVD-2019-12557)

GNU LibreDWG is a GNU Project C library for working with DWG files. A buffer overflow vulnerability exists in the 'dwgdxfBLOCKCONTROL' function of the dwg.spec file in GNU LibreDWG version 0.7 and 0.7.1645. An attacker could exploit this vulnerability to cause a denial of service or disclose...

GNU LibreDWG Buffer Overflow Vulnerability (CNVD-2019-12552)

GNU LibreDWG is a GNU Project C library for working with DWG files. A buffer overflow vulnerability exists in the 'bitreadB' function of the bits.c file in GNU LibreDWG version 0.7 and 0.7.1645. An attacker could exploit this vulnerability to cause a denial of service or disclose information...

The vulnerability in the web interface of software for network monitoring in Cisco Network Assurance Engine allows a perpetrator to disclose protected information or cause service failures.

The vulnerability of the software web interface for network monitoring in the Cisco Network Assurance Engine lies in the use of pre-installed credentials. Exploiting this vulnerability can allow attackers to disclose sensitive information or cause service failures...