The vulnerabilities of the components of the Automationworx Software Suite, including PC Worx, PC Worx Express, and Config+, allow attackers to disclose protected information and execute arbitrary code.

The vulnerability of the components of the Automationworx Software Suite, including PC Worx, PC Worx Express, and Config+, lies in the ability to read data beyond the designated memory area. Exploiting this vulnerability allows an attacker to disclose sensitive information and execute arbitrary...

Default Express middleware security check is ignored in production

Default Express middleware security check is ignored in production Impact All Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default express authentication middleware in production environment are affected. Patches @cubejs-backend/[email protected] Workaround...

GHSA-4J6X-W426-6RC6 Default Express middleware security check is ignored in production

Default Express middleware security check is ignored in production Impact All Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default express authentication middleware in production environment are affected. Patches @cubejs-backend/[email protected] Workaround...

PT-2019-20000

Name of the Vulnerable Software and Affected Versions @cubejs-backend/api-gateway versions prior to 0.11.17 Description The default Express middleware security check is ignored in production, affecting all Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default...

Out-of-bounds

An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+...

CVE-2019-16675

An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+...

CVE-2019-16675: Out-of-bounds Read

An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+...

IBM SterlinIBM Sterling Connect:Express for UNIX FTP Server Buffer Overflow Vulnerability

IBM Sterling Connect:Express for UNIX is a file transfer solution for the UNIX platform from IBM.FTP Server is one of the FTP File Transfer Protocol parsers. A buffer overflow vulnerability exists in FTP Server in IBM Sterling Connect:Express for UNIX version 1.5.0.16, which stems from a failure ...

CVE-2019-16330

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

CVE-2019-16330

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

CVE-2019-16330

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

CVE-2019-16330

CVE-2019-16330 affects NCH Express Accounts Accounting v7.02, with a persistent XSS in Invoices/Sales Orders/Items/Customers/Quotes input fields. An authenticated unprivileged user can modify these fields to inject arbitrary JavaScript, enabling client-side script execution. Connected documents c...

CVE-2019-16330: Improper Neutralization of Input During Web Page Generation

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

PT-2019-14630

Name of the Vulnerable Software and Affected Versions NCH Express Accounts Accounting version 7.02 Description The issue concerns a persistent cross-site scripting XSS flaw in the input fields for Invoices, Sales Orders, Items, Customers, and Quotes. An authenticated, unprivileged user can modify...

Accounts Accounting 7.02 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Express Accounts Accounting 7.02 - Persistent Cross-Site Scripting Exploit Author: Debashis Pal Vendor Homepage: https://www.nchsoftware.com Source: https://www.nchsoftware.com/accounting/index.html Version: Express Accounts...

Accounts Accounting 7.02 Cross Site Scripting

Exploit Title: Express Accounts Accounting 7.02 - Persistent Cross-Site Scripting Exploit Author: Debashis Pal Date: 2019-10-16 Vendor Homepage: https://www.nchsoftware.com Source: https://www.nchsoftware.com/accounting/index.html Version: Express Accounts Accounting v7.02 CVE : N/A Tested on:...

Accounts Accounting 7.02 - Persistent Cross-Site Scripting

Accounts Accounting 7.02 - Persistent Cross-Site Scripting Exploit Title: Express Accounts Accounting 7.02 - Persistent Cross-Site Scripting Exploit Author: Debashis Pal Date: 2019-10-16 Vendor Homepage: https://www.nchsoftware.com Source: https://www.nchsoftware.com/accounting/index.html Version...

Accounts Accounting 7.02 - Persistent Cross-Site Scripting

Exploit Title: Express Accounts Accounting 7.02 - Persistent Cross-Site Scripting Exploit Author: Debashis Pal Date: 2019-10-16 Vendor Homepage: https://www.nchsoftware.com Source: https://www.nchsoftware.com/accounting/index.html Version: Express Accounts Accounting v7.02 CVE : N/A Tested on:...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by CVE-2019-17495 via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: CVE-2019-17495 Source advisory: OSV:GHSA-C427-HJC3-WRFW...

Denial of Service

Overview Versions of express-fileupload prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed up to 30s in internal testing if the request contains a large filename of . characters. Recommendation Upgrade to version 1.1.6-alpha.6 or later...