CVE-2019-6971: Undefined Security Weakness

An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packet to the router management web interface, and fully control the router without knowledge of the credentials...

Malicious Module

bowee has a malicious module in the form of a preinstall script. The script gets a backdoor file from a remote server and executes it, subsequently giving full control of the computer to an external malicious entity...

CVE-2019-1590: Improper Certificate Validation

A vulnerability in the Transport Layer Security TLS certificate validation functionality of Cisco Nexus 9000 Series Application Centric Infrastructure ACI Mode Switch Software could allow an unauthenticated, remote attacker to perform insecure TLS client authentication on an affected device. The...

PT-2019-2057

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Application Centric Infrastructure ACI Mode Switch Software affected versions not specified Description The issue is related to errors in Transport Layer Security TLS certificate validation, which could allow a remote...

The vulnerability of the Portable Clusterware component of the Oracle Database Server management system allows a hacker to gain full control over the application.

The vulnerability of the Portable Clusterware component of the Oracle Database Server management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of Oracle Java SE’s 2D software platform allows a hacker to gain full control over the application.

The vulnerability of the Oracle Java SE 2D software platform is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker operating remotely to gain full control over the application...

The vulnerability of the Windows DLL component of the Oracle Java SE software platform allows a perpetrator to gain full control over the application.

The vulnerability of the Windows DLL component of the Oracle Java SE software platform is related to access control deficiencies. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full control over the application through network protocols...

The vulnerability of the Connector/J sub-component of the MySQL Connectors component of the Oracle MySQL database management system allows a hacker to gain full control over the application.

The vulnerability of the Connector/J sub-component of the MySQL Connectors component of the Oracle MySQL database management system is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain full control over the application using the JDBC protocol...

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool, which allows a hacker to gain full control over the application

The vulnerability of the Core component of Oracle VM VirtualBox is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool, which allows a hacker to gain full control over the application

The vulnerability of the Core component of Oracle VM VirtualBox is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool, which allows a hacker to gain full control over the application

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool is related to lack of access control mechanisms. Exploiting this vulnerability can allow an attacker to gain full control over the application...

PT-2019-1858

Name of the Vulnerable Software and Affected Versions Java SE versions 7u211 and 8u202 Description The issue is related to insufficient access control in the Java SE 2D component, allowing a remote attacker to gain full control over the application. This vulnerability can be exploited by an...

CVE-2019-9733

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...

CVE-2019-9733: Undefined Security Weakness

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...

GOG Galaxy Games directory insecure file permissions local privilege elevation vulnerability

Summary An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy’s “Games” directory. An attacker can overwrite executables of installed games to exploit this vulnerability and execute arbitrary code with elevated privileges. Tested Versions Gog...

GOG Galaxy updater temp directory insecure file permissions local privilege elevation vulnerability

Summary An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy’s Temp directory. An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with SYSTEM privileges. Tested Versions...

Command Execution Vulnerability in Qiji Transportation and Maintenance Bastion Machine

Qiji Technology is the creator and leader of Fortress Ops Platform / Ops Audit, and is the only vendor in China that specializes in the field of Ops Management. After installing ShtermClient-2.1.1.exe, the Qiji Ops Fortress client software registers a customized protocol shterm on a personal...

CVE-2018-18435

KioWare Server version 4.9.6 and older installs by default to "C:\kiowarecom" with weak folder permissions granting any user full permission "Everyone: F" to the contents of the directory and it's sub-folders. In addition, the program installs a service called "KWSService" which runs as...

PT-2019-9668

Name of the Vulnerable Software and Affected Versions Opera versions prior to 57.0.3098.106 Description The issue allows an attacker to perform a DLL Search Order hijacking attack by sending a ZIP archive containing an HTML page and a malicious DLL. This can enable the attacker to gain full contr...

Moxa IKS and EDS predictable cookie vulnerabilities

Moxa IKS and EDS is a series of industrial switches introduced by Moxa. A predictable cookie vulnerability exists in the Moxa IKS and EDS series. The vulnerability stems from software that generates a predictable cookie calculated using MD5 hashing, which can be exploited by an attacker to captur...