CVE-2020-3114 Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based...

Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability (cisco-sa-ucm-csrf-NbhZTxL)

According to its self-reported version, Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected device. This is due to due to insufficient CSRF protections. An attacker could exploit this vulnerability...

Oracle PeopleSoft Enterprise PeopleTools Elastic Search Data Read

The vulnerability of the Oracle PeopleSoft Enterprise PeopleTools Elastic Search component of the Oracle PeopleSoft products lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to gain read access to data through HTTP requests...

Junos OS: Cross-Site Scripting (XSS) in J-Web (JSA10986)

According to its self-reported version number, the remote Juniper Junos device is affected by a cross-site scripting XSS vulnerability in J-Web due to insufficient XSS protection. An unauthenticated, remote attacker can exploit this, via injecting web script or HTML to hijack the target user's...

Insufficiently Protected Credentials in Apache Tomcat

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

Mail.ru: API method at api.my.games allows to enumerate user emails

API method which allowed to enumerate emails at https://api.my.games/ was not sufficiently protected...

Mail.ru: Account Takeover worki.ru

worki.ru had no sufficient protection against SMS code bruteforce...

Mail.ru: Account TakeOver through password recovery at am.ru

Insufficient protection allowed account takeover at am.ru via account recovery code bruteforcing Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

Mail.ru: Account Takeover at vseapteki.ru

Insufficient protection against SMS code bruteforcing allowed account takeover in vseapteki.ru Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

CVE-2019-16722

ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...

CVE-2019-15330

The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading...

CVE-2019-15330

The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading...

CVE-2019-15330: Undefined Security Weakness

The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading...

CVE-2019-9013

An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component a...

CVE-2019-1874

A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the...

CVE-2019-1874 Cisco Prime Service Catalog Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the...

Cisco Integrated Management Controller Information Disclosure Vulnerability

A vulnerability in the Server Utilities of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to gain unauthorized access to sensitive user information from the configuration data that is stored on the affected system. The vulnerability is due to insufficient...

CVE-2019-0178

Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access...

Cisco Application Policy Infrastructure Controller Disclosure

The vulnerability of the Cisco Application Policy Infrastructure Controller web interface is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow a malicious actor to gain access to protected data remotely...

PT-2019-11651

Name of the Vulnerable Software and Affected Versions: Robotronic RunAsSpc version 3.7.0.0 Description: The issue allows locally authenticated attackers to obtain cleartext credentials of stored accounts due to insufficient protection of stored credentials. Recommendations: For version 3.7.0.0,...