CVE-2018-19487: Exposure of Sensitive Information to an Unauthorized Actor

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users...

AZL-37151 CVE-2019-3816 affecting package openwsman for versions less than 2.6.8-13

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman serve...

CVE-2019-3777: Improper Certificate Validation

Pivotal Application Service PAS, versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could...

CVE-2019-3922

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, unauthenticated attacker to /GponForm/fsetupForm. An attacker can leverage this vulnerability to potentially execute arbitrary code...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

McAfee Agent Denial of Service Vulnerability

The McAfee Agent is a distributed component of McAfee ePolicy Orchestrator McAfee ePO that downloads and enforces policies, performs client-side tasks such as deployments and updates, and also uploads events and provides other data about the status of each system. A denial of service vulnerabilit...

CVE-2019-3598

CVE-2019-3598 affects McAfee Agent (MA) 5.x where a bug in how UDP requests are processed leads to a denial of service when handling specially crafted UDP packets. The vulnerability allows remote, unauthenticated attackers to potentially cause the MA service to stop responding, reducing availabil...

CVE-2019-3599 McAfee Agent update fixes an Information Disclosure vulnerability

Information Disclosure vulnerability in Remote logging which is disabled by default in McAfee Agent MA 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled...

CVE-2019-3598: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer Access with Incorrect Length Value in McAfee Agent MA 5.x allows remote unauthenticated users to potentially cause a denial of service via specifically crafted UDP packets...

CVE-2019-3599: Undefined Security Weakness

Information Disclosure vulnerability in Remote logging which is disabled by default in McAfee Agent MA 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled...

NTPsec ntpd ctl_getitem Out of Bounds Read (CVE-2019-6443)

An out of bounds read vulnerability has been reported in NTPsec ntpd. The vulnerability is due to insufficient validation of the length of a message in a NTP packet. A remote unauthenticated user can exploit this vulnerability by sending a crafted packet to the target server...

Advanced Comment System 1.0 Cross Site Scripting

...

CVE-2019-3924: Unintended Proxy or Intermediary

MikroTik RouterOS before 6.43.12 stable and 6.42.12 long-term is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for...

CVE-2015-9282: Improper Neutralization of Input During Web Page Generation

The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard...

CVE-2018-18940

servlet/SnoopServlet a servlet installed by default in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=XSS in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web...

Denial of service

In Rockwell Automation FactoryTalk Services Platform 2.90 and earlier, a remote unauthenticated attacker could send numerous crafted packets to service ports resulting in memory consumption that could lead to a partial or complete denial-of-service condition to the affected services...

CVE-2018-6444

A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands...

CVE-2018-6444

A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands...

CVE-2018-6445

A Vulnerability in Brocade Network Advisor versions before 14.0.3 could allow a remote unauthenticated attacker to export the current user database which includes the encrypted not hashed password of the systems. The attacker could gain access to the Brocade Network Advisor System after...

CVE-2018-6444

A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands...