PT-2019-3022 · Cisco · Cisco Ucs Director Express For Big Data +2

Name of the Vulnerable Software and Affected Versions: Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

CVE-2019-1974: Improper Authentication

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user...

PT-2019-11415

Name of the Vulnerable Software and Affected Versions: Kentico Xperience versions 9.x and earlier Kentico Xperience versions 10.0.x through 10.0.51 Kentico Xperience versions 11.0.x through 11.0.47 Kentico Xperience versions 12.0.x through 12.0.14 Description: The issue is related to the...

nodejs: Inspector DNS rebinding vulnerability

It was found that when a Node.js script is run in inspector mode, Node.js did not properly validate the Host header, leaving the inspector vulnerable to a DNS rebind attack and bypass same-origin policy. If a developer had an inspector session running, and was visiting a malicious website, the si...

CVE-2018-15402

Cisco Enterprise NFV Infrastructure Software (NFVIS) contains a CSRF vulnerability (CVE-2018-15402) arising from improper Origin header validation in the management HTTP interface. An unauthenticated, remote attacker can lure a user to a malicious page to perform actions with the user’s privilege...

CVE-2018-0455

A vulnerability in the Server Message Block Version 2 SMBv2 and Version 3 SMBv3 protocol implementation for the Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the device to run low on system memory, possibly preventing the device from forwarding traffic. ...

CVE-2018-0455: Undefined Security Weakness

A vulnerability in the Server Message Block Version 2 SMBv2 and Version 3 SMBv3 protocol implementation for the Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the device to run low on system memory, possibly preventing the device from forwarding traffic. ...

Cisco Firepower System Software Detection Engine Denial of Service Vulnerability

A vulnerability in the Server Message Block Version 2 SMBv2 and Version 3 SMBv3 protocol implementation for the Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the device to run low on system memory, possibly preventing the device from forwarding traffic. ...

FreeBSD Denial of Service Vulnerability (CNVD-2020-38783)

FreeBSD is a set of Unix-like free operating systems in the FreeBSD project, headed by the Core Team team, and is an important branch of Unix-like systems that have evolved through BSD, 386BSD, and 4.4BSD. A security vulnerability exists in FreeBSD that stems from the ELF packet header parser not...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19090)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the admincp.php file in version 7.0.11 of idreamsoft iCMS. The vulnerability stems from the detection of CSRFTOKEN when it does not exist, and the program...

Denial of Service Vulnerability in FXOS Software and NX-OS Software Fabric Services Component for Multiple Cisco Products

Cisco Firepower 4100 Series Next-Generation Firewalls are all products of Cisco Corporation.Cisco Firepower 4100 Series Next-Generation Firewalls is a 4100 series firewall device. Cisco Firepower 4100 Series Next-Generation Firewalls are 4100 series firewalls.MDS 9000 Series Multilayer Switches a...

Cisco FXOS and NX-OS CFS Arbitrary Code Execution Vulnerability (CNVD-2018-11965)

Cisco Firepower 4100 Series Next-Generation Firewalls are all products of Cisco Corporation.Cisco Firepower 4100 Series Next-Generation Firewalls is a 4100 series firewall device. Cisco Firepower 4100 Series Next-Generation Firewalls are 4100 series firewalls.MDS 9000 Series Multilayer Switches a...

CVE-2018-0312

A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition on an affected device. The vulnerability exists because the affected software...

CVE-2018-8244

An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook...

Microsoft Outlook elevation of privilege vulnerability (CNVD-2018-13288)

Microsoft Outlook is an e-mail client software bundled with the Office suite from Microsoft USA. The software manages e-mail, contacts, calendars, and more. An elevation of privilege vulnerability exists in Microsoft Outlook that originates from the program failing to properly validate attachment...

UBUNTU-CVE-2016-10721

partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to execute arbitrary code in the context of the user running the affected application...

Design/Logic Flaw

In the uncurlwsaccept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation accepting an arbitrary substring match for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full...

CVE-2018-6651

CVE-2018-6651 affects uncurl (uncurl.c) in uncurl before 0.07, as used in Parsec before 140-3. The issue is insufficient Origin header validation for WebSocket API requests (accepting an arbitrary substring match), which enables remote attackers to bypass access restrictions and, in Parsec, could...

CVE-2018-6651: Cross-Site Request Forgery (CSRF)

In the uncurlwsaccept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation accepting an arbitrary substring match for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full...

Android Qualcomm Linux boot information disclosure vulnerability (CNVD-2017-34672)

Android on Google Pixel and Nexus is an open source Linux-based operating system for the Google Pixel and Nexus smartphones developed by Google Inc. and the Open Handheld Alliance OHA.Qualcomm Linux boot is one of the Linux boot programs. Qualcomm Linux boot is one of the Linux boot programs. An...