Authentication flaw

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device...

CVE-2019-3910

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device...

CVE-2018-20713

Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404...

Authorization Bypass In The InvokeNextValue Function

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

Privilege Escalation

pacemaker is vulnerable to privilege escalation attacks. The vulnerability exists as pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command...

Denial Of Service (DoS)

mysql55-mysql is vulnerable to denial of service DoS attacks. The vulnerability exists through an unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC...

Information Disclosure

openstack-heat is vulnerable to information disclosure attacks. The vulnerability exists as OpenStack Orchestration API Heat 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL...

Arbitrary Code Execution

rubygem-openshift-origin-node is vulnerable to arbitrary code execution attacks. The vulnerability exists as Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced...

Escalation Of Privileges

python-keystoneclient is vulnerable to remote authenticated users gaining privileges. The authtoken middleware doesn't correctly retrieve user tokens from memcache, allowing remote authenticated users to gain privileges by issuing a large number of requests...

Privilege Escalation

openstack-keystone is vulnerable to privilege escalation attacks. The vulnerability exists as OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by...

Denial Of Service (DoS)

mongodb is vulnerable to denial of service DoS attacks. The vulnerability exists as the default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service crash or read system memory via a crafted BSON object in the colum...

Denial Of Service (DoS)

mongodb is vulnerable to denial of service DoS attacks. The vulnerability exists as MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service invalid memory...

Information Disclosure

redhat-ds-base is vulnerable to information disclosure attacks. The vulnerability exists as the Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a...

ICSA-19-038-01 Siemens SICAM A8000 RTU Series

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SICAM A8000 RTU Vulnerability: Uncaught Exception 2. RISK EVALUATION The SICAM A8000 RTU series is affected by a security vulnerability that could allow unauthenticated remote...

Cross site scripting

A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to adherents/type.php...

CVE-2018-19992

Dolibarr 8.0.2 is affected by CVE-2018-19992: a stored XSS vulnerability allowing remote authenticated users to inject arbitrary script/HTML via the address or town POST parameters to adherents/type.php. This is confirmed across multiple connected sources (NVD OSV GNHS). The documents do not spec...

Fortify Software Security Center (SSC) 17.1017.2018.10 - Information Disclosure

Fortify Software Security Center SSC 17.1017.2018.10 - Information Disclosure Details ================ Software: Fortify SSC Software Security Center Version: 17.10, 17.20 & 18.10 Homepage: https://www.microfocus.com Advisory report: https://github.com/alt3kx/CVE-2018-7690 CVE: CVE-2018-7690 CVSS...

Code injection

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions...

Integer overflow

In FreeBSD before 11.2-STABLEr340854 and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 request. Unprivileged remote users with access to the NFS server can crash the system by sending a specially crafted NFSv4 request...

CVE-2018-17159

In FreeBSD before 11.2-STABLEr340854 and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. Unprivileged remote users with access to the NFS server can cause a resource exhaustion by forcing the server to allocate an arbitrarily large memory allocation...