CVE-2019-2281

An unauthenticated bitmap image can be loaded in to memory and subsequently cause execution of unverified code. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 665, SD 675...

Session fixation

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass...

CVE-2018-17210

An issue was discovered in PrinterOn Central Print Services CPS through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass...

PT-2019-11553 · Unknown +1 · Libiec61850 +1

Name of the Vulnerable Software and Affected Versions: libiec61850 versions 1.3.0 through 1.3.2 Description: The issue is related to a Buffer Overflow, which can cause a software crash. The component affected is the server example complex array. The attack vector involves sending a specific MMS...

CVE-2019-12803

In Hunesion i-oneNet version 3.0.7 3.0.53 and 4.0.4 4.0.16, the specific upload web module doesn't verify the file extension and type, and an attacker can upload a webshell. After the webshell upload, an attacker can use the webshell to perform remote code exection such as running a system comman...

Microsoft Office Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents. An attacker who successfully exploited this vulnerability could read or write information in Office documents. The security update addresses the...

Foxit Reader AcroForm Memory Misreference Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A memory misreference vulnerability exists in Foxit Reader AcroForm. The vulnerability stems from a failure to verify the existence of an object before performing an operation on it. A remote attacker can exploit this...

Chamilo LMS Code Execution Vulnerability

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. A security vulnerability exists in Chamilo LMS version 1.11.8 and version 2.x,...

CVE-2019-7281

Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website...

PT-2019-18511 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The issue allows an unauthenticated user to send unverified HTTP requests. This may enable an attacker to perform certain actions with administrative privileges if a logged-in user...

ABB HMI Missing Certification Bypass Vulnerability

The ABB CP635 HMI is a human-machine interface control panel from ABB Switzerland. A security vulnerability exists in the ABB CP635 HMI that stems from a transmission method that fails to use any form of encryption or fails to perform reliability checks on binaries of new HMI software. An attacke...

STOPzilla AntiMalware Null Pointer Dereference Vulnerability

STOPzilla AntiMalware is a malware removal software. A null pointer dereference vulnerability exists in the driver file szkg64.sys in STOPzilla AntiMalware 6.5.2.59. The vulnerability stems from an unverified output buffer address value starting at IOCtl 0x80002028. An attacker could exploit this...

Cisco NX-OS Software Data Forgery Issue Vulnerability

Cisco NX-OS Software is a set of data center-grade operating system software for switches from the U.S. company Cisco Cisco. A data forgery vulnerability exists in the Image Signature Verification feature in Cisco NX-OS Software. The vulnerability arises from a network system or product that does...

Schneider Electric Modicon Multiple Controllers Unverified Password Change

Binary data 720246.prm...

Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change

Talos Vulnerability Report TALOS-2018-0749 Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change Vulnerability April 25, 2019 CVE Number CVE-2018-4064 Summary An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sier...

Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change Vulnerability

Summary An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password ...

Authentication Bypass

github.com/snapcore/snapweb is vulnerable to authentication bypass. The identity of the user and the origin of a connection is not verified before allowing controls to install or remove snap packages. An unauthenticated remote attacker is able to add a malicious snap package from the store and us...

Logic flaw vulnerability exists in UsualToolCMS of Chengdu Comfidonte Network Technology Co.

UsualToolCMS UTCMS is a content management system and rapid site building framework. A logic flaw vulnerability exists in UsualToolCMS v8.0 build 190101. The vulnerability stems from the program not verifying the identity of the data passed by the processing user. An attacker could overstep his/h...

PT-2019-19338 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions 2.2.8 through 2.2.9 Description: An issue was discovered that allows unauthenticated blind time-based SQL injection via the m1 idlist parameter in the News module. This can be achieved through a crafted URL. The issue...

PT-2019-2028 · Python +8 · Python +8

Name of the Vulnerable Software and Affected Versions: Python versions 2.x through 2.7.16 Description: The issue is related to the urllib module in Python, which supports the local file: scheme. This makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs. A...