CVE-2019-16388

PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/randomtoken/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and th...

CVE-2019-16387

PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/randomtoken/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchemaListDatabases request while using a low-privilege account. This can perform actions and retrieve data that only an administrator should have access to. NOTE: The vendor states that...

CVE-2019-16386

PEGA Platform 7.x–8.x is disclosed to have an information-disclosure vulnerability, exploitable via a direct request to /prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id to obtain database schema information. Dispute exists about privilege level (v...

Default credentials

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license...

CVE-2019-14890

CVE-2019-14890 affects Ansible Tower up to version 3.6.0, where plaintext RHSM credentials stored in the database at /api/v2/config could be exposed when applying the license. The Red Hat advisory RHSA-2019:3958 confirms a fix in Ansible Tower 3.6.1-1 for EL7, addressing the information disclosur...

CVE-2019-14890

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license...

CVE-2019-15276

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

PT-2019-11637 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions 4.1 and 4.2 Description: The issue allows a low-privileged user to read pod logs and discover secret material if the log level in an operator has been set to Debug or higher by a privileged user. This...

CVE-2019-10617

Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the registry in QCA61749377.WIN.1.0 in QCA61749377...

Design/Logic Flaw

Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the registry in QCA61749377.WIN.1.0 in QCA61749377...

CVE-2019-10617

Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the registry in QCA61749377.WIN.1.0 in QCA61749377...

PT-2019-11947

Name of the Vulnerable Software and Affected Versions QCA6174 9377.WIN.1.0 in QCA6174 9377 Description The issue allows low privilege users to access service configuration, which contains registry data used by administrators to create or delete entries in the registry. Recommendations For QCA6174...

CVE-2019-3028

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.34 and prior to 6.0.14. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2019-3026

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.34 and prior to 6.0.14. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2019-3015

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Integration Broker. Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterpri...

CVE-2019-3021

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.34 and prior to 6.0.14. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2019-2980

Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications component: eMail. Supported versions that are affected are 12.0.2 and 12.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2019-2961

Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Orac...

CVE-2019-2953

Vulnerability in the Oracle Hospitality Cruise Dining Room Management product of Oracle Hospitality Applications component: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2019-2955

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS...