PT-2019-15908

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.2.0 Description The issue concerns a path traversal vulnerability via ../ in the d or f parameters to "Admin/RoxyFileman/ProcessRequest" due to a flaw in "Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

CVE-2019-19642

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or...

Command injection

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or...

CVE-2019-19642

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or...

CVE-2019-19642

CVE-2019-19642 affects SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68. The vulnerability in the Virtual Media feature allows OS command injection by authenticated attackers who can send HTTP POST requests to the IPMI interface at /rpc/setvmdrive.asp, including shell metach...

PT-2019-15898

Name of the Vulnerable Software and Affected Versions SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68 Description The issue allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This is achieved by sending a POST request t...

CVE-2019-19642: Improper Neutralization of Special Elements used in an OS Command

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or...

Omron PLC 1.0.0 Denial Of Service

Exploit Title: Omron PLC 1.0.0 - Denial of Service PoC Google Dork: n/a Date: 2019-12-06 Exploit Author: n0b0dy Vendor Homepage: https://automation.omron.com, ia.omron.com Software Link: n/a Version: 1.0.0 Tested on: PLC f/w rev.: CJ2M v2.01 CWE-412 : Unrestricted Externally Accessible Lock CVE :...

lucie-f-zeven.e-monsite.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1026700 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

PT-2019-4881

Name of the Vulnerable Software and Affected Versions GNU Bash versions 5.0 patch 11 and earlier Description An issue was discovered in the disable priv mode function in shell.c. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its...

CVE-2014-3875

The addto parameter to fup in Frams' Fast File EXchange FEX, aka fex before fex-2014053 allows remote attackers to conduct cross-site scripting XSS attacks...

CVE-2014-3875

The addto parameter to fup in Frams' Fast File EXchange FEX, aka fex before fex-2014053 allows remote attackers to conduct cross-site scripting XSS attacks...

CVE-2014-3875

The CVE-2014-3875 entry documents a cross-site scripting (XSS) vulnerability in Frams’ Fast File Exchange (F*EX, fex) prior to fex-2014053, where the addto parameter of fup can be exploited to inject HTML/headers. Debian DLA-68-1 confirms this issue and lists fixes for the fex package (versions a...

Unspecified Vulnerability in Blackview BV9000Pro-F

The Blackview BV9000Pro-F is a smartphone from Blackview of Hong Kong, China. A security vulnerability exists in the Blackview BV9000Pro-F build fingerprint: Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys in the com.mediatek. A security vulnerability exists in the...

CVE-2019-15420

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

Code injection

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15420

CVE-2019-15420 affects Blackview BV9000Pro-F (Android 7.1.1, build Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys). A pre-installed app com.mediatek.factorymode (version 1) enables unauthorized wireless settings modification via a confused deputy attack, accessible to...

CVE-2019-15420

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15420: Externally Controlled Reference to a Resource in Another Sphere

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

PT-2019-14149

Name of the Vulnerable Software and Affected Versions Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys Description The issue concerns a pre-installed app with a package name of com.mediatek.factorymode tha...