CVE-2019-3569: Files or Directories Accessible to External Parties

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versio...

Optergy Proton/Enterprise Authentication Error Vulnerability

Optergy Proton/Enterprise is an enterprise building management system from Optergy USA. An authentication error vulnerability exists in Optergy Proton/Enterprise versions 2.3.0a and earlier. An attacker could exploit the vulnerability to gain direct party access to specific resources...

Siemens SCALANCE W1750D 6GK5750-2HX01-1AA0 Controller-based Direct Access Point

Binary data 764354.prm...

September 20, 2018—KB4457141 (OS Build 15063.1358)

None None...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change

Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on: Windows CVE: - Class: Unauthorized Admin Credential Change...

Information disclosure

Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token...

CVE-2014-5130

The CVE-2014-5130 entry applies to Avolve Software ProjectDox 8.1 . The vulnerability is described as an information disclosure where remote authenticated users can obtain sensitive data from other users via vectors involving a direct access token. The connected documentation confirms multiple re...

CVE-2014-5130: Exposure of Sensitive Information to an Unauthorized Actor

Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token...

PT-2018-4256

Name of the Vulnerable Software and Affected Versions Avolve Software ProjectDox version 8.1 Description The issue allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token. Recommendations For Avolve Software ProjectDox version...

CVE-2017-17898

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to .tpl.php files, which allows remote attackers to obtain sensitive information...

CVE-2017-17898

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to .tpl.php files, which allows remote attackers to obtain sensitive information...

NPM-V (Network Power Manager) 2.4.1 - Password Reset

NPM-V Network Power Manager 2.4.1 - Password Reset NPM-VNetwork Power Manager = 2.4.1 Reset Password Vulnerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NPM-V Affected Version : 2.4.1 and below Vendor : http://www.china-clever.com Product Link :...

VMSA-2017-0012:VMware VIX API VM Direct Access Function security issue

VMSA-2017-0012 VMware VIX API VM Direct Access Function security issue VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2017-0012 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware VIX API VM Direct Access Function security issue VMware...

kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c

It was found that the Linux kernel can hit a BUGON statement in the xfsgetblocks in the fs/xfs/xfsaops.c because of a race condition between direct and memory-mapped I/O associated with a hole in a file that is handled with BUGON instead of an I/O failure. This allows a local unprivileged attacke...

NetScaler: Error - "your apps are not available at this time" when login from Receiver

NetScaler: Error - "your apps are not available at this time" when login from Receiver. This occurs when going via the NetScaler gateway . Direct access to SF works fine, as well as browser access to gateway works fine...

Deploying CloudBridge Virtual WAN in Virtual Inline Mode with Additional Internet Link

This article addresses the deployment of a Cloud Bridge Appliance in Virtual Inline Mode with additional internet link enabled with Internet Services. This deployment serves the requirement where we do not need the traffic intended for internet access to traverse the virtual path between the site...

Exemys Telemetry Web Server Authentication Bypass Vulnerability

Exemys Telemetry Web Server is a web-based SCADA system from Exemys Argentina. A security vulnerability exists in Exemys Telemetry Web Server. An attacker can exploit this vulnerability by ignoring the location header to gain direct access to information...

Apache Struts vulnerable to cross-site scripting

Overview Apache Struts provided by the Apache Software Foundation is a software framework for creating web applications in Java. Apache Struts is vulnerable to cross-site scripting when JSP files can be accessed directly. Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. reported this...

Direct access of prefixed controller actions

More info at https://bakery.cakephp.org/2015/08/06/cakephp2592610272released.html...

Wave OA the platform there is a common SQL injection(sa permissions)lead Getshell-a vulnerability warning-the black bar safety net

POST /login. aspx HTTP/1.1 Content-Length: 3 4 2 Content-Type: application/x-www-form-urlencoded User-Agent: Googlebot/2.1 +http://www.googlebot.com/bot.html X-Requested-With: XMLHttpRequest Referer: http://124.133.235.142/ Host: 124.133.235.142 Connection: Keep-alive Accept-Encoding:...