MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure

Exploit: MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure Date: 2019-12-30 Author: LiquidWorm Vendor: Emmanuel Product web page: https://github.com/empierre/MyDomoAtHome https://www.domoticz.com/wiki/ImperiHome https://docs.imperihome.com/app/iss Affected version: 0.2.40...

PT-2019-5322

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

PT-2019-5339

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

PT-2019-5341

Name of the Vulnerable Software and Affected Versions Cisco UCS Director and Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of the affected devices, which may allow a remote attacker to...

Exploit for Code Injection in Mongo-Express_Project Mongo-Express

CVE-2019-10758 PoC Setup docker run -p 27017:27017 -...

The vulnerability of the Cisco Unity Express aut secretary, related to the refusal to accept measures for eliminating special elements used in the operating system’s command, allows a hacker to elevate their privileges and execute arbitrary code.

The vulnerability of the Cisco Unity Express autochanger lies in its inability to accept measures to neutralize special elements. Exploiting this vulnerability may allow an attacker to enhance their privileges and execute arbitrary code...

mongo-express code execution vulnerability

mongo-express is a lightweight web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express versions prior to 0.54.0. An attacker can exploit this vulnerability to execute code with the help of an endpoint using the toBSON method...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the "toBSON" method. A misuse of the "vm" dependency to perform "exec" commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

MongoDB mongo-express ≤0.53.x is vulnerable to Remote Code Execution via endpoints using toBSON, due to unsafe use of the vm module to run exec commands. Affected component: mongo-express server-side routes that invoke toBSON. Root cause: misusing vm to execute commands in a non-safe environment....

CVE-2019-10758: Improper Control of Generation of Code

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

Vulnerability of the iwl_pcie_ctxt_info_gen3_init() function (drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c) in the Linux kernel, allowing a hacker to cause a service failure

The vulnerability of the iwlpciectxtinfogen3init function located in the drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c file in the Linux kernel leads to uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the `mwifiex_pcie_init_evt_ring()` function (driver/net/wireless/marvell/mwifiex/pcie.c) in the Linux kernel allows a hacker to trigger a service failure.

The vulnerability of the mwifiexpcieinitevtring function drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a attacker to cause service failures...

PT-2019-5342

Name of the Vulnerable Software and Affected Versions Cisco UCS Director and Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of the affected software, which may allow a remote attacker to...

PT-2019-5337

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

PT-2019-5336

Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...

CVE-2019-10694

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and...