8578 matches found
CVE-2019-13658
CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...
CVE-2019-13658
CA Network Flow Analysis versions 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to bypass authentication and execute arbitrary commands , compromising system security. The issue is documented across multiple sources (CVE-2019-13658 references and the Syma...
CVE-2019-13658: Use of Hard-coded Credentials
CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...
HTTP/2: request for large response leads to denial of service
A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...
HTTP/2: request for large response leads to denial of service
A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...
CA Network Flow Analysis CVE-2019-13658 Default Credentials Security Bypass Vulnerability
Description CA Network Flow Analysis is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and execute arbitrary command. The following versions are vulnerable: CA Network Flow Analysis 10.0.xCA Network Flow Analysis 9.x Technologie...
EulerOS 2.0 SP8 : wavpack (EulerOS-SA-2019-2095)
According to the versions of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults...
Couchbase Server Code Injection Vulnerability
Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . A code injection vulnerability exists in Couchbase Server version 5.1.1. The...
CVE-2019-16899
In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...
CVE-2019-16899
In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...
CVE-2019-16899
CVE-2019-16899 affects Advantech WebAccess/HMI Designer 2.1.9.31. The vulnerability arises from data from a faulting address that controls code flow at PM_V3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918, enabling potential denial of service. Multiple sources (NVD, Red Hat, CVE listings) conf...
CVE-2019-16899
In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...
CVE-2019-16899: Undefined Security Weakness
In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...
Traffic of any type doesn't pass through SDWAN Firewall
Traffic is sent from Zone A to Zone B. Firewall Policy Policy Ais configured to ALLOW 10.10.10.x IP source to Any destination with Highest Priority. Another Firewall policy Policy Bis set to DENY from Any source to Any destination with Least priority. Issue is that the Traffic always hits the Den...
project-inheritance showed secret environment variables defined in Mask Passwords Plugin
Mask Passwords Plugin allows users to define secret environment variables typically passwords to be passed to builds, both globally, and for specific jobs. These environment variables are expected to not be shown. project-inheritance showed the variable values on its Full Build Flow view and...
Shopify: Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission
Technical Background ===================== Shopify Apps need an access token to work with the data of a store. Is very important to keep this token in a secure place. Quoting the Shopify Blog: ... this is like a password into this shop, so you’ll want to store this token in a very safe place...
Shopify: Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections
The following report intends to disclose a bypass for 416983. It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description Signed URLs generated by Shopify Flow https://apps.shopify.com/flow use a...
LY Corporation: Reflected XSS in OAUTH2 login flow
The reporter found a reflected XSS in the OAUTH2 login flow which could have allowed potential attackers to steal credentials or hijack accounts by sending a message to the victim containing a malicious URL...
Denial Of Service (DoS)
OpenCV is vulnerable to denial of service DoS. There is an out-of-bounds read in DIS optical flow evaluation implementation when the function halbaseline::vload in core/hal/intrinsse.hpp is called from computeSSDMeanNorm in modules/video/src/disflow.cpp...