CVE-2019-17243

CVE-2019-17243 affects IrfanView 4.53 with a memory-corruption vulnerability that allows data from a faulting address to influence code flow at JPEG_LS+0x3155. The NVD entry describes it as a memory corruption issue in IrfanView 4.53 leading to potential control of execution (crash or code flow a...

Broadcom CA Network Flow Analysis Default Credentials Vulnerability

Broadcom CA Network Flow Analysis is a network traffic monitoring solution from Broadcom. A security vulnerability exists in Broadcom CA Network Flow Analysis versions 9.x and 10.0.x. The vulnerability arises from a lack of an effective trust management mechanism in a network system or product. T...

CVE-2019-13658

CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

CVE-2019-13658

CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

Design/Logic Flaw

CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

CVE-2019-13658

CA Network Flow Analysis versions 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to bypass authentication and execute arbitrary commands , compromising system security. The issue is documented across multiple sources (CVE-2019-13658 references and the Syma...

CVE-2019-13658

CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

Terraform AWS Secure Baseline - Terraform Module To Set Up Your AWS Account With The Secure Baseline Configuration Based On CIS Amazon Web Services Foundations

Terraform Module Registry A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.2.0. See Benchmark Compliance to check which items in CIS benchmark are covered. Starting from v0.10.0...

CA Network Flow Analysis CVE-2019-13658 Default Credentials Security Bypass Vulnerability

Description CA Network Flow Analysis is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and execute arbitrary command. The following versions are vulnerable: CA Network Flow Analysis 10.0.xCA Network Flow Analysis 9.x Technologie...

EulerOS 2.0 SP8 : wavpack (EulerOS-SA-2019-2095)

According to the versions of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults...

Couchbase Server Code Injection Vulnerability

Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . A code injection vulnerability exists in Couchbase Server version 5.1.1. The...

CVE-2019-16899

In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...

CVE-2019-16899

In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...

CVE-2019-16899

CVE-2019-16899 affects Advantech WebAccess/HMI Designer 2.1.9.31. The vulnerability arises from data from a faulting address that controls code flow at PM_V3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918, enabling potential denial of service. Multiple sources (NVD, Red Hat, CVE listings) conf...

CVE-2019-16899

In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...

Traffic of any type doesn't pass through SDWAN Firewall

Traffic is sent from Zone A to Zone B. Firewall Policy Policy Ais configured to ALLOW 10.10.10.x IP source to Any destination with Highest Priority. Another Firewall policy Policy Bis set to DENY from Any source to Any destination with Least priority. Issue is that the Traffic always hits the Den...

Shopify: Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission

Technical Background ===================== Shopify Apps need an access token to work with the data of a store. Is very important to keep this token in a secure place. Quoting the Shopify Blog: ... this is like a password into this shop, so you’ll want to store this token in a very safe place...

Shopify: Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections

The following report intends to disclose a bypass for 416983. It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description Signed URLs generated by Shopify Flow https://apps.shopify.com/flow use a...