Design/Logic Flaw

A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information...

CVE-2018-21026

CVE-2018-21026 affects Hitachi Command Suite 7.x and 8.x up to but not including 8.6.5-00. An unauthenticated remote user can read internal information. The vulnerability is documented across multiple sources (NVD, RH, JVN, CNVD) with the impact described as information disclosure. Mitigation per...

CVE-2019-17360

CVE-2019-17360 affects Hitachi Command Suite 7.x and 8.x prior to 8.7.0-00. unauthenticated remote users can trigger a denial-of-service due to Uncontrolled Resource Consumption. Multiple sources (NVD, Red Hat entry, CVE records) confirm the affected product family and vulnerable condition; no ex...

CVE-2019-17360

A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service DoS condition because of Uncontrolled Resource Consumption...

EulerOS 2.0 SP5 : httpd (EulerOS-SA-2019-2157)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes...

Siemens Siprotec Missing Authentication for Critical Function

A vulnerability has been identified in Siemens DIGSI 4 All versions V4.92, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module PROFINET IO variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module DNP3 variant All versions,...

MikroTik RouterOS 6.45.6 - DNS Cache Poisoning

MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Exploit Title: MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Date: 2019-10-30 Exploit Author: Jacob Baines Vendor Homepage: https://mikrotik.com/ Software Link: https://mikrotik.com/download Version: 6.45.6 Stable and below or 6.44.5 Long-term and...

MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Exploit

Exploit Title: MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Exploit Author: Jacob Baines Vendor Homepage: https://mikrotik.com/ Software Link: https://mikrotik.com/download Version: 6.45.6 Stable and below or 6.44.5 Long-term and below Tested on: Various x86 and MIPSBE RouterOS installs CVE :...

MikroTik RouterOS 6.45.6 - DNS Cache Poisoning

Exploit Title: MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Date: 2019-10-30 Exploit Author: Jacob Baines Vendor Homepage: https://mikrotik.com/ Software Link: https://mikrotik.com/download Version: 6.45.6 Stable and below or 6.44.5 Long-term and below Tested on: Various x86 and MIPSBE RouterOS...

kube-apiserver: DoS with crafted patch of type json-patch

A denial of service vulnerability was found in the Kubernetes API server. A remote user, with authorization to apply patches, could exploit this via crafted JSON input, causing excessive consumption of resources and subsequent denial of service...

FreeBSD : FreeBSD -- Insufficient message length validation in bsnmp library (45a95fdd-f680-11e9-a87f-a4badb2f4699)

A function extracting the length from type-length-value encoding is not properly validating the submitted length. Impact : A remote user could cause, for example, an out-of-bounds read, decoding of unrelated data, or trigger a crash of the software such as bsnmpd resulting in a denial of service....

Information Disclosure

github.com/cloudfoundry/smbdriver is vulnerable to information disclosure. Confidential information such as volume usernames and passwords are written into the SMB volume logs, allowing a remote user with access to the logs to retrieve the credentials and gain access to the SMB volumes of other...

CVE-2019-11283

Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume...

Default credentials

Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume...

CVE-2019-11283 Password leak in smbdriver logs

Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume...

CVE-2019-11283: Insertion of Sensitive Information into Log File

Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume...

CVE-2019-11283: Password leak in smbdriver logs | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created...

Security Bulletin: IBM® InfoSphere Balanced Warehouse, IBM Smart Analytics System and IBM PureData System for Operational Analytics are affected by an IBM DB2® LUW denial of service vulnerability in ALTER MODULE statement handling (CVE-2014-3094)

Summary The IBM InfoSphere Balanced Warehouse C3000, C4000, D5100, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700, 7710 and IBM PureData System for Operational Analytics ship with either IBM DB2 Version 9.7 or Version 10.1. IBM DB2 is vulnerable to a stack buffer overflow, caused b...

CVE-2018-1273

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

CVE-2019-3765

Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1, 2.2, 2.3 and 2.4 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A remote authenticated malicious user potentially could...