CVE-2019-0202

CVE-2019-0202 affects Apache Storm Logviewer: versions 0.9.1-incubating through 1.2.2 expose HTTP endpoints that allow reading arbitrary host files via the logviewer. The root cause is an information disclosure vulnerability in the log viewer endpoints, enabling reading files not intended for acc...

Exploit for CVE-2019-14339

CVE-2019-14339 Content Provider URI Injection on Canon PRINT...

Deserialization Of Untrusted Object

Apache Storm UI Deamon is vulnerable to deserialization of untrusted object. When it is using with storm-kafka-client or storm-kafka modules, it does not filter the input of untrusted bytes before deserialization, allowing an attacker to provide malicious bytes to abuse the logic of the applicati...

CVE-2018-11779: Deserialization of Untrusted Data

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

CVE-2019-0202: Exposure of Sensitive Information to an Unauthorized Actor

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

Apache Storm Deserialization Vulnerability

Apache Storm is the United States Apache Apache Software Foundation, a set of open source distributed real-time computing system using Clojure concurrent programming language development. A deserialization vulnerability exists in Apache Storm versions 1.1.0 through 1.2.2. The vulnerability stems...

CVE-2019-0046

A vulnerability in the pfe-chassisd Chassis Manager CMLC daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A...

Design/Logic Flaw

A vulnerability in the pfe-chassisd Chassis Manager CMLC daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A...

CVE-2019-0046

Summary: CVE-2019-0046 affects Juniper Networks Junos OS on EX4300 Series, via the pfe-chassisd Chassis Manager (CMLC) daemon. The vulnerability allows an attacker to cause a Denial of Service by sending specific valid broadcast packets that trigger a broadcast storm on the me0 interface, requiri...

CVE-2019-0046: Uncontrolled Resource Consumption

A vulnerability in the pfe-chassisd Chassis Manager CMLC daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A...

The vulnerability of the “GCSvc.exe” service in the information protection system against unauthorized access by the Storm NT security system allows a intruder to cause a service failure.

The vulnerability of the “GCSvc.exe” service in the information protection system against unauthorized access, managed by the Storm NT security system, is related to incorrect processing of input data. Exploiting this vulnerability could allow an intruder, operating locally, to cause a service...

The vulnerability of the GShell.dll library in the information protection system against unauthorized access by Storm NT allows a perpetrator to bypass the ASLR protection mechanism.

The vulnerability of the GShell.dll library in the information protection system against unauthorized access is related to the incorrect implementation of address space randomization ASLR. Exploiting this vulnerability can allow an intruder acting locally to bypass the ASLR protection mechanism...

Authentication flaw

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. Furthermore, the user account that controls the web...

CVE-2019-12777

CVE-2019-12777 affects ENTTEC Datagate Mk2, Storm 24, Pixelator, and E-Streamer Mk2 firmware 70044_update_05032019-482, where startup scripts replace secure directory permissions with permissive rwxrwxrwx on /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin. This is an Incorrect Permission A...

CVE-2019-12776

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocaterevB scripts copies the hardcoded key to...

CVE-2019-12775

CVE-2019-12775 affects ENTTEC Datagate Mk2, Storm 24, Pixelator (firmware 70044_update_05032019-482 and prior). The issue enables high-privileged root access via sudo for the www-data/web-app user without proper access control, potentially allowing execution of high-privilege binaries/assets pres...

CVE-2019-12775

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. Furthermore, the user account that controls the web...

CVE-2019-12777: Incorrect Permission Assignment for Critical Resource

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They replace secure and protected directory permissions set as default by the underlying operating system with highly insecure read, write, and execute directory...

CVE-2019-12776: Use of Hard-coded Credentials

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocaterevB scripts copies the hardcoded key to...

CVE-2019-12775: Improper Privilege Management

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. Furthermore, the user account that controls the web...