mongo-express code execution vulnerability

mongo-express is a lightweight web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express versions prior to 0.54.0. An attacker can exploit this vulnerability to execute code with the help of an endpoint using the toBSON method...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

MongoDB mongo-express ≤0.53.x is vulnerable to Remote Code Execution via endpoints using toBSON, due to unsafe use of the vm module to run exec commands. Affected component: mongo-express server-side routes that invoke toBSON. Root cause: misusing vm to execute commands in a non-safe environment....

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the "toBSON" method. A misuse of the "vm" dependency to perform "exec" commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758: Improper Control of Generation of Code

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

The vulnerability of the `mwifiex_pcie_init_evt_ring()` function (driver/net/wireless/marvell/mwifiex/pcie.c) in the Linux kernel allows a hacker to trigger a service failure.

The vulnerability of the mwifiexpcieinitevtring function drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a attacker to cause service failures...

Vulnerability of the iwl_pcie_ctxt_info_gen3_init() function (drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c) in the Linux kernel, allowing a hacker to cause a service failure

The vulnerability of the iwlpciectxtinfogen3init function located in the drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c file in the Linux kernel leads to uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2019-5342

Name of the Vulnerable Software and Affected Versions Cisco UCS Director and Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of the affected software, which may allow a remote attacker to...

PT-2019-5337

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

PT-2019-5336

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

CVE-2019-10694

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and...

CVE-2019-10694

CVE-2019-10694 affects Puppet Enterprise where the Express install could leave an overlooked default password for the admin user if the user did not use the URL provided to set the password. The issue is resolved in Puppet Enterprise 2019.0.3 and in 2018.1.9. The public descriptions consistently ...

PT-2019-11997

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2019.0.3 Puppet Enterprise versions prior to 2018.1.9 Description The express install of Puppet Enterprise provides a URL to set the admin password at the end of the installation. However, if this URL is not...

CVE-2019-10694: Use of Hard-coded Credentials

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and...

Concrete CMS: XSS in select attribute options

To reproduce 1. Create a new select attribute. 2. Add a select attribute option with value alert'XSS' and hit Save. 3. Edit the newly created attribute again and see XSS dialog. The vulnerability lays in the typeform.php file, see...

Microsoft Visual Basic 2010 Express - XML External Entity Injection

Exploit Title: Microsoft Visual Basic 2010 Express - XML External Entity Injection Exploit Author: ZwX Exploit Date: 2019-12-03 Version Software : 10.0.30319.1 RTMRel Vendor Homepage : https://www.microsoft.com/ Software Link:...

Node.js third-party modules: [express-laravel-passport] Improper Authentication

I would like to report Improper Authentication in express-laravel-passport It allows to forge user's identity Module module name: express-laravel-passport version: 1.1.2 npm page: https://www.npmjs.com/package/express-laravel-passport Module Description You want a middleware support express get...