Cisco Web Security Appliance SSL Certificate Verification Failure

The vulnerability of the SSL traffic decryption function in Cisco Web Security Appliance relates to insufficient verification of Secure Sockets Layer server certificates. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by installing incorrectly generated...

Jenkins Token Macro Plugin XML Link Restriction

The vulnerability of the Jenkins Token Macro plugin is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to forge requests on the server side or cause service failures...

Ignited CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-22258)

Ignited CMS is a content management system CMS. A cross-site request forgery vulnerability exists in index.php/admin/permissions in Ignited CMS on 2017-02-19 and prior versions, which stems from a networked system or product that does not adequately validate the origin or authenticity of data, an...

IBM Security Access Manager Appliance Open Redirection Vulnerability

IBM Security Access Manager Appliance ISAM Appliance is a network appliance-based security solution from IBM, USA. The product is mainly used for access control and Web-based threat protection, providing system performance monitoring, log analysis and diagnosis. There is a security vulnerability ...

CVE-2019-12836

The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link to an existing issue that can cause forgery of a request to an out-of-origin domain. This in turn may allow for a forged request that can be invoked in the context of an authenticated user, leading to stealing ...

CVE-2019-12836

The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link to an existing issue that can cause forgery of a request to an out-of-origin domain. This in turn may allow for a forged request that can be invoked in the context of an authenticated user, leading to stealing ...

Code injection

The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis leading to potentially forged application message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industri...

CVE-2018-13906

The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis leading to potentially forged application message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industri...

PT-2019-8996

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions affected versions not specified Description The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis, potentially allowing forged application messages. This issue affects various...

CVE-2018-13906: Improper Input Validation

The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis leading to potentially forged application message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industri...

WordPress Satoshi Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. Cross-site request forgery vulnerability exists in WordPress Satoshi, where an attacker,...

Mozilla Firefox has an unspecified vulnerability (CNVD-2019-17483)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 67. An attacker could exploit the vulnerability to forge cursors...

Key Reinstallation Attack (KRACK)

WPA and WPA2 are vulnerable to key reinstallation attacks KRACK. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by reinstalling a previously used group key GTK during a 4-way handshake...

CVE-2019-5431

This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter"...

CVE-2019-7644

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

PT-2019-18678

Name of the Vulnerable Software and Affected Versions Auth0 Auth0-WCF-Service-JWT versions prior to 1.0.4 Description The issue allows an attacker to forge an arbitrary JWT token that will be accepted by the vulnerable application if the error message containing the expected JWT signature is...

WordPress Limit Login Attempts Reloaded 2.7.4 Bypass

!/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded Version: 2.7.4 Tested on: WordPress 5.1.1 Descriptio...

Cisco SPA112 SPA525 SPA5X5 Certificate Processing Information Disclosure

The vulnerability of the certificate processing component in Microprogramming Software for Cisco SPA112, SPA525, and SPA5X5 Series devices is related to errors during certificate verification on the server side. Exploiting this vulnerability can allow an attacker to gain access to protected...

Arbitrary file download vulnerability in s-cms news portal system do***.php page

An arbitrary file download vulnerability exists in the do.php page of the s-cms news portal system, which allows an attacker to forge cookies to bypass authentication and download files at will...

PT-2018-2720

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.5.1 Description A flaw in the verification of certain S/MIME signatures in Thunderbird causes emails to be displayed as having a valid digital signature, even if the message contents are not covered by the...