CVE-2019-11454

Persistent cross-site scripting XSS in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an...

Oracle E-Business Suite Multiple Vulnerabilities (Apr 2019 CPU)

The version of Oracle E-Business installed on the remote host is missing the April 2019 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory : - An unspecified flaw exists in the Oracle Advanced Outbound...

ASP.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A...

Cisco IOS and IOS XE Smart Reporting Service Certificate Validation Vulnerability

Cisco IOS Internet Operating System is a proprietary operating system that runs on most Cisco routers and switches.Cisco IOS XE is a modular operating system based on the Linux kernel. A certificate validation vulnerability exists in the Cisco Smart Call Home feature of Cisco IOS and IOS XE. The...

PT-2019-1714 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software affected versions not specified Cisco IOS XE Software affected versions not specified Description: A parsing issue on DNS packets in the Network-Based Application Recognition NBAR feature could allow an unauthenticated,...

openwsman: Disclosure of arbitrary files outside of the registered URIs

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman serve...

Default credentials

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csresetpass function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account...

Denial of Service in PAN-OS Management Interface

A Denial of Service vulnerability exists in the SNMP library that affects PAN-OS Management Interface. Ref PAN-106922, CVE-2018-18065. Successful exploitation of this issue would allow a remote unauthenticated user to cause the SNMP daemon to crash, resulting in a denial of service. The...

AZL-37151 CVE-2019-3816 affecting package openwsman for versions less than 2.6.8-13

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman serve...

CVE-2019-3922

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, unauthenticated attacker to /GponForm/fsetupForm. An attacker can leverage this vulnerability to potentially execute arbitrary code...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

McAfee Agent Denial of Service Vulnerability

The McAfee Agent is a distributed component of McAfee ePolicy Orchestrator McAfee ePO that downloads and enforces policies, performs client-side tasks such as deployments and updates, and also uploads events and provides other data about the status of each system. A denial of service vulnerabilit...

CVE-2019-3599 McAfee Agent update fixes an Information Disclosure vulnerability

Information Disclosure vulnerability in Remote logging which is disabled by default in McAfee Agent MA 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled...

CVE-2019-3598

CVE-2019-3598 affects McAfee Agent (MA) 5.x where a bug in how UDP requests are processed leads to a denial of service when handling specially crafted UDP packets. The vulnerability allows remote, unauthenticated attackers to potentially cause the MA service to stop responding, reducing availabil...

NTPsec ntpd ctl_getitem Out of Bounds Read (CVE-2019-6443)

An out of bounds read vulnerability has been reported in NTPsec ntpd. The vulnerability is due to insufficient validation of the length of a message in a NTP packet. A remote unauthenticated user can exploit this vulnerability by sending a crafted packet to the target server...

Advanced Comment System 1.0 Cross Site Scripting

...

CVE-2018-18940

servlet/SnoopServlet a servlet installed by default in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=XSS in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web...

Denial of service

In Rockwell Automation FactoryTalk Services Platform 2.90 and earlier, a remote unauthenticated attacker could send numerous crafted packets to service ports resulting in memory consumption that could lead to a partial or complete denial-of-service condition to the affected services...

CVE-2018-6444

A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands...

CVE-2018-6444

A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands...