CVE-2019-19782

The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server...

The vulnerability of the sub-component SciLexer.dll, a text editing component of the text editor Scintilla (Notepad++), allows an attacker to cause a service failure or execute arbitrary code.

The vulnerability of the SciLexer.dll sub-component of the Scintilla text editor Notepad++, relates to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by using a specially created .ml file containing...

terminal-plus-atm.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1028466 Security Researcher PoisoNBlEedinG Helped patch 114 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting terminal-plus-atm.ru website and its users...

Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions

Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions Exploit Title: Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions Discovery by: hyp3rlinx Date: 2019-12-02 Vendor Homepage: www.maxpcsecure.com Tested Version: 19.0.4.020 CVE: N/A + Credits: John Page aka hyp3rlinx +...

Samsung A8+ has an unspecified vulnerability

Samsung A8+ is a smartphone from Samsung South Korea. A security vulnerability in the Samsung A8+ build fingerprint: samsung/jackpot2ltexx/jackpot2lte:8.0.0/R16NW/A730FXXS4BSC2:user/release-keys in the com.samsung.android. A security vulnerability exists in the themecenter app. An attacker could...

WordPress buddypress-activity-plus plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress buddypress-activity-plus plugin. The...

Code injection

The Xiaomi 5S Plus Android device with a build fingerprint of Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via ...

Input validation

The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

CVE-2019-15426

CVE-2019-15426 affects the Xiaomi 5S Plus Android device (build fingerprint Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys). A pre-installed app (package com.miui.powerkeeper, versionCode 40000, versionName 4.0.00) enables unauthorized wireless settings modification via a confused de...

CVE-2019-15426

The Xiaomi 5S Plus Android device with a build fingerprint of Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via ...

CVE-2019-15342

The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

CVE-2019-15341

CVE-2019-15341 affects Tecno Camon iAir 2 Plus devices (build TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys). A pre-installed platform app com.lovelyfont.defcontainer (versionCode 7, versionName 7.0.11) exposes an exported service, com.lovelyfont.manager.service.FunctionService...

CVE-2019-15341

The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

IBM Spectrum Protect Plus Insecure File Permissions Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

ABB Power Generation Information Manager (PGIM) and Plant Connect

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Power Generation Information Manager PGIM and Plant Connect Vulnerability: Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this...

CVE-2019-4652

IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963...

CVE-2019-4652

IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963...

CVE-2019-4652

IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963...

CVE-2019-4652

Affected software: IBM Spectrum Protect Plus, versions 10.1.0 through 10.1.4, on Windows. Issue: restored NTFS permissions (ACLs) are not preserved during file restore, potentially allowing a local attacker to access sensitive data or perform unauthorized actions. Root cause: insecure file permis...