CVE-2019-3995

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash the ELOG server by sending a crafted HTTP GET request...

CVE-2019-3994

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG server by sending multiple HTTP POST requests which causes the ELOG function retrieveurl to use a freed variable...

CVE-2019-3995

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash the ELOG server by sending a crafted HTTP GET request...

CVE-2019-3994

CVE-2019-3994 affects ELOG 3.1.4-57bea22 and earlier. The vulnerability is a denial-of-service caused by a use-after-free in the retrieve_url() function, enabling a remote unauthenticated attacker to crash the ELOG server by sending multiple HTTP POST requests. The public documents consistently d...

CVE-2019-3995: NULL Pointer Dereference

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash the ELOG server by sending a crafted HTTP GET request...

CVE-2019-3994: Use After Free

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG server by sending multiple HTTP POST requests which causes the ELOG function retrieveurl to use a freed variable...

PT-2020-9609 · Ksh +3 · Ksh +3

Name of the Vulnerable Software and Affected Versions: ksh version 20120801 Description: A flaw was found in the way ksh evaluates certain environment variables, allowing an attacker to override or bypass environment restrictions to execute shell commands. Services and applications that allow...

CVE-2019-19649: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function...

CVE-2019-3666 API Abuse Vulnerability

API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor WA prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a carefully crafted web site...

CVE-2019-3666

CVE-2019-3666 affects McAfee Web Advisor (WA) web interface prior to version 4.1.1.48. The vulnerability is described as an API abuse/misuse in the WA web interface that allows a remote, unauthenticated attacker to induce the browser to navigate to restricted websites via a specially crafted web ...

CVE-2019-3665: Improper Control of Generation of Code

Code Injection vulnerability in the web interface in McAfee Web Advisor WA prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would normally have blocked via a carefully crafted web site...

CVE-2019-18580

Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host...

CVE-2019-11289: Improper Input Validation

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash...

CVE-2018-20687

An XML external entity XXE vulnerability in CommandCenterWebServices/.?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2018-20687

An XXE vulnerability exists in Raritan CommandCenter Secure Gateway (CC-SG) before version 8.0.0, in CommandCenterWebServices/.*?wsdl. The flaw allows remote unauthenticated attackers to read arbitrary files or perform server-side request forgery (SSRF) via a crafted DTD in an XML request. Exploi...

CVE-2018-20687: Improper Restriction of XML External Entity Reference

An XML external entity XXE vulnerability in CommandCenterWebServices/.?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

Updated proftpd packages fix security vulnerabilities

Updated proftpd package fixes security vulnerabilities: It was discovered that the modcopy module of ProFTPD, a FTP/SFTP/FTPS server, performed incomplete permission validation for the CPFR/CPTO commands CVE-2019-12815. It was discovered that due to incorrect handling of overly long commands, a...

CVE-2019-3978

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning...

CVE-2019-3978: Missing Authentication for Critical Function

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning...

GHSA-J52R-XC68-Q8F4 Insufficiently Protected Credentials in Pivotal Reactor Netty

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...