CVE-2020-9279: Use of Hard-coded Credentials

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device...

PT-2020-2044

Name of the Vulnerable Software and Affected Versions Xilinx Spartan, Artix, Kintex, and Virtex affected versions not specified Description The issue is related to a programmable user vulnerability in the programmable logic integrated circuits PLICs of Xilinx Spartan, Artix, Kintex, and Virtex...

PT-2020-2640

Name of the Vulnerable Software and Affected Versions Oracle Solaris versions 10 and 11 Description The issue is related to insufficient input validation in the Common Desktop Environment component of Oracle Solaris. This can be exploited by an attacker to gain full control over the application...

PT-2020-5290

Name of the Vulnerable Software and Affected Versions D-Link DSL-2640B version B2 EU 4.01B Description The issue is related to the use of hard-coded account credentials in the D-Link DSL-2640B router. This allows an attacker to log in to the management interface with high privileges, enabling the...

ZOHO ManageEngine Remote Access Plus Elevation of Privilege Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An elevation of privilege vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.258, which can be exploited by an attacker to elevate privileges and take full control of the application...

The vulnerability of the Graphics Device Interface (GDI) component in Windows operating systems allows a hacker to gain full control over the system or execute arbitrary code.

The vulnerability of the Graphics Device Interface GDI component in Windows operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to gain full control over the system or execute arbitrary code using a specially created documen...

tomcat: local privilege escalation

A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker without access to the Tomcat process or configuration files could be able to manipulate the RMI registry to perform a man-in-the-middle attack. The attacker could then capture user...

The vulnerability of the iw_webs component in the wireless access point software for Moxa AWK-3131A industrial systems allows a hacker to gain full control over the device.

The vulnerability of the iwwebs component in the wireless access point software for Moxa AWK-3131A industrial systems exists due to the lack of measures taken to neutralize the special elements used in the operating system. Exploiting this vulnerability can allow a malicious actor to gain full...

The vulnerability of the Operating System Image component of the Sun ZFS Storage Appliance Kit (AK) allows a hacker to gain full control over the application.

The vulnerability of the Operating System Image component of the Sun ZFS Storage Appliance Kit exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application...

LiveZilla Live Chat Elevation of Privilege Vulnerability

LiveZilla Live Chat is a free online customer service system from the German company LiveZilla. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A security vulnerability exists in the 'name' functi...

The vulnerability of Oracle Java SE’s 2D software platform allows a hacker to gain full control over the application.

The vulnerability of the Oracle Java SE 2D software platform is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker operating remotely to gain full control over the application...

PT-2020-1753

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A firmware version 1.13 Description An exploitable command injection issue exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands,...

CVE-2019-5142: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker operating remotely to gain full control over the application...

The vulnerability of the implementation of the polymorphic data typing mechanism in the FasterXML Jackson-databind library allows a attacker to gain full control over the application.

The vulnerability of the polymorphic data typing mechanism implemented in the FasterXML Jackson-databind library is related to deficiencies in input data processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full control over the application using the...

The vulnerability of the WLS Core Components of the Oracle WebLogic Server application server allows a hacker to gain full control over the application.

The vulnerability of the WLS Core Components component of Oracle WebLogic Server applications is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

Vulnerability of the Application Container component – The JavaEE application server Oracle WebLogic Server allows attackers to gain full control over the application.

The vulnerability of the Application Container component – the JavaEE application server Oracle WebLogic Server – is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application through the use of t...

The vulnerability of the Oracle Solaris operating system’s Consolidation Infrastructure component allows a hacker to gain full control over the operating system.

The vulnerability of the Oracle Solaris operating system’s Consolidation Infrastructure component is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain full control over the operating system...

The vulnerability in the Serialization component of Oracle Java SE and Java SE Embedded software platforms allows a hacker to gain full control over the application.

The vulnerability of the Serialization component in Oracle Java SE and Java SE Embedded software platforms is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain full control over the application...

CVE-2019-10779: Improper Neutralization of Input During Web Page Generation

All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS...