Huawei EulerOS: Security Advisory for php (EulerOS-SA-2019-1333)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-6862

V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code...

Information disclosure

V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code...

CVE-2019-4559

IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 166355...

Information disclosure

IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 166355...

CVE-2019-4559

IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 166355...

Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)

Subrion CMS 4.0.5 - Cross-Site Request Forgery Add Admin Exploit Title: Subrion CMS 4.0.5 - Cross-Site Request Forgery Add Admin Date: 2020-01-05 Exploit Author: Ismail Tasdelen Vendor Homepage: https://intelliants.com/ Software Link : https://github.com/intelliants/subrion/releases/tag/v4.0.5...

FreeBSD : Gitlab -- Multiple Vulnerabilities (01bde18a-2e09-11ea-a935-001b217b3468)

SO-AND-SO reports : Group Maintainers Can Update/Delete Group Runners Using API GraphQL Queries Can Hang the Application Unauthorized Users Have Access to Milestones of Releases Private Group Name Revealed Through Protected Tags API Users Can Publish Reviews on Locked Merge Requests DoS in the...

Gitlab -- Multiple Vulnerabilities

The GitLab Team reports: Group Maintainers Can Update/Delete Group Runners Using API GraphQL Queries Can Hang the Application Unauthorized Users Have Access to Milestones of Releases Private Group Name Revealed Through Protected Tags API Users Can Publish Reviews on Locked Merge Requests DoS in t...

Samsung J6 Access Control Error Vulnerability

The Samsung J6 is a smartphone from the South Korean company Samsung Samsung. An access control error vulnerability exists in the Samsung J6. The vulnerability stems from the network system or product not properly restricting access to resources from unauthorized roles. An attacker could exploit...

Samsung XCover4 Access Control Error Vulnerability (CNVD-2020-14771)

Samsung XCover4 is a smartphone from Samsung South Korea. An access control error vulnerability exists in the Samsung XCover4. The vulnerability stems from the network system or product not properly restricting access to resources from unauthorized roles. An attacker could exploit the vulnerabili...

DEBIAN-CVE-2019-3866

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information...

Schneider-electric Modicon Use of Hard-coded Credentials

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML...

CVE-2013-1811

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...

CVE-2013-1811

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...

Online Store System Access Control Error Vulnerability

Online Store System is an e-commerce system. An Access Control Error vulnerability exists in Online Store System v1.0. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit the vulnerability...

Lark Technologies: [CSRF] No Csrf protection against sending invitation to join the team.

A Cross-Site Request Forgery CSRF vulnerability was found on a "Create Invite" endpoint, which could result in any users being added to a team by tricking another user to run this Proof of Concept. We thank @imrannisar for reporting this to our team...

CVE-2019-3421

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

Command injection

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

CVE-2019-3421

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...