Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)

Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure PoC Discovery Date: 2019-01-31 Exploit Author: Nolan B. Kennedy nxkennedy Vendor Homepage: https://www.verodin.com/ Software Link : https://www.verodin.com/demo-request/demo-request-form Tested Versions...

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking banking analysis system, a simulation-based financial services application, allows a perpetrator to disclose protected information.

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system, a simulation-based application, relates to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose...

CVE-2019-19837

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server, and the Microsoft SharePoint Foundation software for electronic document management exists due to a faulty limitation on the path name to the restricted access catalog. This allows attackers to exploit the protected resources.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server, and the Microsoft SharePoint Foundation software exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability can allow a malicious actor to disclose...

The vulnerability of the Remote Desktop Web Access service in Windows operating systems allows a perpetrator to disclose protected information.

The vulnerability of the Remote Desktop Web Access service in Windows operating systems with authentication processing errors. Exploiting this vulnerability can allow a malicious actor to disclose protected information from a remote location...

The vulnerability of ViewPoint video terminals models 9630, 9650, and 9660 is related to the use of insufficiently random values, which allows attackers to disclose protected information.

The vulnerability of ViewPoint video terminals models 9630, 9650, and 9660 is related to the use of insufficiently random values. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

The vulnerability of the Apache HTTP Server’s virtualization software, Centreon VM, allows attackers to disclose protected information.

The vulnerability of the Apache HTTP Server’s virtualization software, Centreon VM, is related to errors in cookie file processing. Exploiting this vulnerability allows a remote attacker to disclose sensitive information...

The vulnerability of the Adobe Digital Editions e-book reading program, related to reading beyond the buffer limit, allows a intruder to disclose protected information.

The vulnerability of the Adobe Digital Editions e-book reading software relates to reading outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

The vulnerability of Adobe Connect’s instant messaging program lies in the lack of protection for service data, which allows attackers to disclose protected information.

The vulnerability of the Adobe Connect instant messaging program is related to the lack of protection for administrative data. Exploiting this vulnerability can allow a malicious actor to disclose protected information from a remote location...

The vulnerability of the server management application for CentOS Web Panel lies in the lack of protection for operational data, allowing attackers to disclose sensitive information.

The vulnerability of the CentOS Web Panel administration application lies in the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information remotely...

CVE-2019-9232

In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483...

The vulnerability of the String#unpack method in the Ruby programming language allows attackers to exploit it to disclose protected information.

The vulnerability of the Stringunpack method in the Ruby programming language is related to the use of uncontrolled format strings. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information that is protected by this method...

CVE-2019-2230

In nfcManagerrouteAid and nfcManagerunrouteAid of NativeNfcManager.cpp, there is possible memory reuse due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions...

Microsoft Windows Media Center XML Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WINDOWS-MEDIA-CENTER-MOTW-BYPASS-XXE-ANNIVERSARY-EDITION.txt + ISR: Apparition Security Vendor www.microsoft.com Product Microsoft Windows Media Center Windows Media Center is...

Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass

Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass Exploit Title: Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass Discovery by: hyp3rlinx Date: 2019-12-03 Vendor Homepage: www.microsoft.com CVE: N/A + Credits: John Page aka hyp3rlinx + Website:...

The vulnerability of Eclipse Jetty servlet containers, related to the lack of protection for service data, allows attackers to exploit the protected information.

The vulnerability of Eclipse Jetty servlet containers is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information by specifying the full path to the base resources in Windows...

The vulnerability of the Apache Tomcat application server arises from synchronization errors when using a shared resource, allowing attackers to expose sensitive information.

The vulnerability of the Apache Tomcat application server arises due to synchronization errors when using a shared resource. Exploiting this vulnerability allows a malicious actor to disclose sensitive information remotely...

The vulnerability of Eclipse Jetty servlet containers, related to the lack of protection for service data, allows attackers to exploit the protected information.

The vulnerability of Eclipse Jetty servlet containers is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

Google Chrome Out-of-Bounds Read Vulnerability (CNVD-2019-43386)

Chrome is a simple and efficiently designed web browsing tool developed by Google. An out-of-bounds read vulnerability exists in Skia in versions prior to Google Chrome 75.0.3770.80. A remote attacker can exploit this vulnerability to obtain sensitive information from process memory via specially...

CVE-2019-15687

Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component was vulnerable to remote disclosure of various information about the user's system like Window...