3731 matches found
Code injection
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message...
Code injection
AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the report parameter of the BIRT viewer servlet...
DEBIAN-CVE-2012-4434
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service server crash or possibly execute arbitrary code...
Code injection
PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file...
Design/Logic Flaw
An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remote authenticated users can crash a device with a special packet because of Uncontrolled Resource Consumption...
Code injection
SaltStack RSA Key Generation allows remote users to decrypt communications...
CVE-2019-19502
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code...
CVE-2019-14345
TemaTres 3.0 allows remote unprivileged users to create an administrator account...
CVE-2019-14345
TemaTres 3.0 allows remote unprivileged users to create an administrator account...
Improper access control
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...
Authorization
Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server TIE Server 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages...
MikroTik RouterOS 6.45.6 DNS Cache Poisoning
Exploit Title: MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Date: 2019-10-30 Exploit Author: Jacob Baines Vendor Homepage: https://mikrotik.com/ Software Link: https://mikrotik.com/download Version: 6.45.6 Stable and below or 6.44.5 Long-term and below Tested on: Various x86 and MIPSBE RouterOS...
Oracle Business Intelligence Publisher Multiple Vulnerabilities (April 2016 CPU)
The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.160119, 11.1.1.9.x prior to 11.1.1.9.160119, or 12.2.1.0.x prior to 12.2.1.0.160419. It is, therefore, affected by multiple vulnerabilities as noted in the April 2016 Critical Patch...
Oracle Business Intelligence Publisher Information Disclosure (Oct 2016 CPU)
The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.160719, 11.1.1.9.x prior to 11.1.1.9.161018, or 12.2.1.0.x prior to 12.2.1.0.161018. It is, therefore, affected by an unspecified vulnerability in the BI Publisher component in Oracle...
Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jul 2016 CPU)
The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.160719, 11.1.1.9.x prior to 11.1.1.9.160719, or 12.2.1.0.x prior to 12.2.1.0.160719. It is, therefore, affected by multiple vulnerabilities as noted in the July 2016 Critical Patch...
CVE-2019-1581
A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prio...
Prima FlexAir Command Injection Vulnerability
Prima Systems FlexAir is an access control system from Prima Systems in Slovenia. A command injection vulnerability exists in Prima FlexAir version 2.3.38 and earlier. A remote authenticated attacker can exploit the vulnerability to execute code as Root...
Path traversal
Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter...