CVE-2019-2979

CVE-2019-2979 is a vulnerability in Oracle FLEXCUBE Direct Banking (Payments) affecting 12.0.2 and 12.0.3. The issue allows a low-privileged, network-accessible attacker (via HTTP) to compromise the product, with successful exploits requiring user interaction from someone other than the attacker....

CVE-2019-2985

The CVE-2019-2985 entry concerns Oracle PeopleSoft PeopleTools Fluid Core with affected versions 8.56 and 8.57. Affects requires network access over HTTP and unauthenticated access, with human interaction required for exploitation. The impact includes unauthorized update/insert/delete and read ac...

CVE-2019-2953

Vulnerability in the Oracle Hospitality Cruise Dining Room Management product of Oracle Hospitality Applications component: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2019-2953

CVE-2019-2953 affects Oracle Hospitality Cruise Dining Room Management (Web Service) in Oracle Hospitality Applications, version 8.0.80. A low-privileged attacker with HTTP network access can obtain unauthorized data access and may perform updates/deletes on affected data. CVSS v3.1 base score 7....

CVE-2019-2929

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Portal. Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2019-2872

Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications component: Point of Sale. Supported versions that are affected are 17.0.3, 18.0.1 and 19.0.0. Difficult to exploit vulnerability allows physical access to compromise Oracle Retail Xstore Point of...

CVE-2019-2872

CVE-2019-2872 affects Oracle Retail Xstore Point of Service (POS) within Oracle Retail Applications. Affected versions: 17.0.3, 18.0.1, 19.0.0. The vulnerability is local/physical in nature, requiring user interaction, and can lead to unauthorized read/update/delete of some Xstore POS data due to...

Unspecified Vulnerability in Oracle E-Business Suite Marketing Component (CNVD-2019-37199)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management and other functions. marketing is one of the...

Joomla MediaLibrary 1.5.26 SQL Injection

Exploit Title : Joomla MediaLibrary 1.5.26 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/10/2019 Vendor Homepage : ordasoft.com Software Information Link : ordasoft.com/media-library-joomla-extension Software Affected Versions : 1.0- 4.0.12...

[SECURITY] Fedora 30 Update: libapreq2-2.13-38.fc30

libapreq is a shared library with associated modules for manipulating client request data via the Apache API. Functionality includes parsing of application/x-www-form-urlencoded and multipart/form-data content, as well as HTTP cookies...

SQL Injection in LibreNMS

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2018-2783

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u181, 7u161 and 8u152; Java SE Embedded: 8u152; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with...

Sql injection

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input validation. An attacker could...

ALPINE-CVE-2019-16403

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values such as address, review, orders, etc. can also be manipulated by other customers...

CVE-2019-16403

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values such as address, review, orders, etc. can also be manipulated by other customers...

CVE-2019-16403

In Webkul Bagisto before 0.1.5, a lack of proper access control allows a user to modify their own data and that of other customers (e.g., address, reviews, orders) via vulnerable customer-endpoints. The root cause is an authorization/control flaw on customer data modification endpoints (e.g., /cu...

Microsoft Compatibility Appraiser Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft Compatibility Appraiser where a configuration file, with local privileges, is vulnerable to symbolic link and hard link attacks. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An...

Binance Confirms Hacker Obtained Its Users' KYC Data from 3rd-Party Vendor

As suspected, the KYC details of thousands of Binance's customers that hackers obtained and leaked online earlier this month came from the company's third-party vendor, Malta-based cryptocurrency exchange Binance confirmed. For those unaware, Binance, the world's largest cryptocurrency exchange b...

CVE-2018-17791

CVE-2018-17791 affects Newgen OmniFlow iBPS 7.0. The root cause is improper server-side validation: client-side validations can be tampered, and non-editable parameters can be modified by editing a disabled form field, causing server-side data to be stored/fetched repeatedly and potentially leadi...

Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability

A vulnerability in Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account scpuser, which has default user...