17076 matches found
Design/Logic Flaw
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion...
Design/Logic Flaw
Rocket.Chat before 2.1.0 allows XSS via a URL on a !title line...
Design/Logic Flaw
In FusionPBX up to v4.5.7, the file app\xmlcdr\xmlcdrdelete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file of the system...
Solaris 11.4 - xscreensaver Privilege Escalation
@Mediaservice.net Security Advisory 2019-02 last updated on 2019-10-16 Title: Local privilege escalation on Solaris 11.x via xscreensaver Application: Jamie Zawinski's xscreensaver 5.39 distributed with Solaris 11.4 Jamie Zawinski's xscreensaver 5.15 distributed with Solaris 11.3 Other versions...
Solaris 11.4 - xscreensaver Privilege Escalation
Solaris 11.4 - xscreensaver Privilege Escalation @Mediaservice.net Security Advisory 2019-02 last updated on 2019-10-16 Title: Local privilege escalation on Solaris 11.x via xscreensaver Application: Jamie Zawinski's xscreensaver 5.39 distributed with Solaris 11.4 Jamie Zawinski's xscreensaver 5....
Solaris xscreensaver 11.4 - Privilege Escalation Exploit
@Mediaservice.net Security Advisory 2019-02 last updated on 2019-10-16 Title: Local privilege escalation on Solaris 11.x via xscreensaver Application: Jamie Zawinski's xscreensaver 5.39 distributed with Solaris 11.4 Jamie Zawinski's xscreensaver 5.15 distributed with Solaris 11.3 Other versions...
Code injection
DISPUTED An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an...
CVE-2019-17526
SageMath Sage Cell Server is affected by a Python code injection vulnerability (CVE-2019-17526) in internet-facing web applications, demonstrated by import ('os').popen('whoami').read(). The issue is described across multiple sources (NVD, Red Hat, CNVD, Veracode, CVE list, etc.) as allowing arbi...
PT-2019-15185 · Sagemath · Sagemath Sage Cell Server
Name of the Vulnerable Software and Affected Versions: SageMath Sage Cell Server versions prior to 2019-10-05 Description: An issue in SageMath Sage Cell Server allows Python Code Injection, enabling malicious actors to execute arbitrary commands on the underlying operating system. This can be...
Design/Logic Flaw
HongCMS 3.0.0 has XSS via the install/index.php servername parameter...
Design/Logic Flaw
A packet containing a malformed DUID can cause the Kea DHCPv6 server process kea-dhcp6 to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2...
Solaris xscreensaver 11.4 - Privilege Escalation
Exploit Title: Solaris xscreensaver 11.4 - Privilege Escalation Date: 2019-10-16 Exploit Author: Marco Ivaldi Vendor Homepage: https://www.oracle.com/technetwork/server-storage/solaris11/ Version: Solaris 11.x Tested on: Solaris 11.4 and 11.3 X86 CVE: N/A !/bin/sh raptorxscreensaver - Solaris 11....
Solaris xscreensaver 11.4 - Privilege Escalation
Solaris xscreensaver 11.4 - Privilege Escalation Exploit Title: Solaris xscreensaver 11.4 - Privilege Escalation Date: 2019-10-16 Exploit Author: Marco Ivaldi Vendor Homepage: https://www.oracle.com/technetwork/server-storage/solaris11/ Version: Solaris 11.x Tested on: Solaris 11.4 and 11.3 X86...
CVE-2019-17356
The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network...
CVE-2019-17356
The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network...
Default credentials
The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network...
CVE-2019-17356
The CVE-2019-17356 entry concerns the Infinite Design Android app (version 3.4.12). The vulnerability arises because the login process transmits a username and password over TCP without encryption, exposing credentials to eavesdropping on public networks. Impact is credential confidentiality risk...
CVE-2019-17356
The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network...