The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV320, Cisco Small Business RV325, Cisco Small Business RV016, Cisco Small Business RV042, and Cisco Small Business RV082 allows a perpetrator to execute arbitrary commands.

The vulnerability of the web-based management interfaces for Cisco Small Business RV320, Cisco Small Business RV325, Cisco Small Business RV016, Cisco Small Business RV042, and Cisco Small Business RV082 is related to the lack of measures for cleaning input data. Exploiting this vulnerability...

The vulnerability of the GDI component of the Windows operating system, which allows a hacker to increase their privileges or execute arbitrary code

The vulnerability of the Graphics Device Interface GDI component in the Windows operating system is related to insecure handling of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges or execute arbitrary code through a specially created application...

The vulnerability in the web interface of the Cisco Unified Contact Center Express software allows a hacker to execute arbitrary code.

The vulnerability in the web interface for controlling the Cisco Unified Contact Center Express software application exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted serialized Java...

The vulnerability in the web-based administration interface of the PAN-OS operating system allows a hacker to gain access to the device.

The vulnerability of the PAN-OS operating system’s administrative web interface is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...

The vulnerability of Cisco Cloud Web Security’s web interface allows attackers to execute arbitrary SQL queries.

The vulnerability of Cisco Cloud Web Security’s web interface relates to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

docker-compose-remote-api injection vulnerability

docker-compose-remote-api is a connection interface between Docker-Compose and the Docker Remote API. An injection vulnerability exists in docker-compose-remote-api 0.1.4 and earlier versions, which stems from the 'execserviceName, cmd, fnStdout, fnStderr, fnExit' function failing to clean up. Th...

CVE-2019-19988

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the filesystem via /common/vameditXml.php in the web interface. The vulnerable PHP page checks none of these: the parameter that identifies the...

CVE-2019-19822

A certain router administration interface that includes Realtek APMIB 0.11f for Boa 0.94.14rc21 allows remote attackers to retrieve the configuration, including sensitive data usernames and passwords. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R...

Cisco IOS and Cisco IOS XE Software Cross-Site Request Forgery Vulnerability

Cisco IOS and IOS XE Software are both operating systems developed by Cisco for its network devices. A cross-site request forgery vulnerability exists in the Web UI in Cisco IOS and Cisco IOS XE Software versions prior to 16.1.1, which stems from a program that does not adequately protect the Web...

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory...

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

A flaw was found in the Linux kernel's implementation of IPMI remote baseband access. An attacker, with local access to read /proc/ioports, may be able to create a use-after-free condition when the kernel module is unloaded which may result in privilege escalation...

The vulnerability in the web interface for managing microprogrammed software in Cisco SPA100 Series IP phones allows a perpetrator to execute arbitrary code with elevated privileges.

The vulnerability in the web interface for managing Microprogramming-based IP phones of the Cisco SPA100 Series is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with elevated privileges using a...

The vulnerability in the web interface of Cisco HyperFlex’s hyper-converged infrastructure allows a attacker to perform arbitrary actions on a vulnerable device using a specially crafted link.

The vulnerability of the web interface for managing Cisco HyperFlex infrastructure is related to errors in authenticating the requests being executed. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device using a specially crafted link...

PT-2019-3234 · Cisco · Cisco Ucs Director Express For Big Data +2

Name of the Vulnerable Software and Affected Versions: Cisco Integrated Management Controller IMC Supervisor versions affected versions not specified Cisco UCS Director versions affected versions not specified Cisco UCS Director Express for Big Data versions affected versions not specified...

PT-2019-3070 · Cisco · Cisco Integrated Management Controller

Name of the Vulnerable Software and Affected Versions: Cisco Integrated Management Controller IMC affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to injec...

Cat Runner Decorate Home for Android Input Validation Error Vulnerability

Cat Runner Decorate Home for Android is a parkour game based on the Android platform. An input validation error vulnerability exists in the application API of Cat Runner Decorate Home version 2.8.0 for Android, which can be exploited by an attacker to modify the application data and obtain more...

CVE-2017-8230

On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security analysis it was identified that a low privileged user who belongs to the "user" group and who has access to login in to the web administrativ...

UBUNTU-CVE-2019-5840

Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

Logic Flaw Vulnerability in eXtplorer Login Interface

eXtplorer is a file management based on PHP and ExtJS development of the text based on PHP and ExtJS development of the file management of the file management device manager . A logic flaw vulnerability exists in the eXtplorer login interface, which can be exploited by an attacker to gain server...

The vulnerability in the web interface for managing Cisco Video Surveillance Manager allows a perpetrator to disclose protected information.

The vulnerability in the web interface for managing Cisco Video Surveillance Manager exists due to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information by sending specially crafted requests...