Siemens SINEMA Remote Connect Server

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SINEMA Remote Connect Server Vulnerabilities: Missing Release of Resource after Effective Lifetime, Infinite Loop 2. RISK EVALUATION Successful exploitation of these vulnerabilities...

Siemens SIMATIC Controller Web Servers

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Controller Web Servers Vulnerability: Uncaught Exception 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a...

ModSecurity 3.0.x Denial Of Service Vulnerability

ModSecurity version 3.0.x suffers from a denial of service vulnerability due to the handling of regular expression matching. ModSecurity version 3.0.x is affected by a denial of service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular...

P2PE v3.0 – Why organizations should prepare now

The Payment Card Industry Security Standards Council PCI SSC published version 3.0 of the Point-To-Point Encryption P2PE standard back in December 2019. The new version simplifies and adds flexibility to the process for component and solution providers to validate their P2PE products for cardhold...

TuziCMS v3.0 Ma*** Ad***.cl***.php suffers from SQL injection vulnerability

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 Ma Ad.cl.php suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

TuziCMS v3.0 Ma*** Us***.cl***.php suffers from SQL injection vulnerability

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 Ma Us.cl.php suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information about the database...

TuziCMS v3.0 Ma*** Ph***.cl***.php suffers from SQL injection vulnerability

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 Ma Ph.cl.php suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information about the database...

CVE-2019-2989

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

Kubernetes: Man in the middle using LoadBalancer or ExternalIPs services

I rated this vulnerability as high because trying to rate it with CVSS v3.0 Calculator gives me 9.9 which seems way too high as you do require to be able to create services in the K8S cluster. Summary: This report details 2 ways to man in the middle traffic by: a creating a LoadBalancer service a...

Gobuster v3.0 - Directory/File, DNS And VHost Busting Tool Written In Go

Gobuster is a tool used to brute-force: URIs directories and files in web sites. DNS subdomains with wildcard support. Virtual Host names on target web servers. Oh dear God.. WHY!? Because I wanted: 1. ... something that didn't have a fat Java GUI console FTW. 2. ... to build something that just...

CVE-2019-16312

s-cms V3.0 has XSS in index.php?type=text via the Sid parameter...

Design/Logic Flaw

s-cms V3.0 has XSS in index.php?type=text via the Sid parameter...

CVE-2019-16312

s-cms V3.0 has XSS in index.php?type=text via the Sid parameter...

CVE-2019-16312

CVE-2019-16312 affects s-cms v3.0 with a stored/reflected XSS in index.php?type=text via the S_id parameter. The Red Hat and NVD entries confirm the same description; public details are limited to the XSS path and parameter, with no explicit exploitation vectors or patched versions provided in th...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2016 - Includes Oracle Jan 2016 CPU affect Content Collector for Email

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for Email. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”...

Security Bulletin:IBM SDK, Java Technology Edition Quarterly CPU - Apr 2016 - Includes Oracle Apr 2016 CPU affect for IBM Connections

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Connections.This issue was disclosed as part of the IBM Java SDK updates in January 2016 Vulnerability Details CVEID: CVE-2016-0264 DESCRIPTION: A...

CVE-2019-8286

Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Product ID by forcing victim to visit a specially crafted webpage for example, via clicking phishing link. Vulnerability has CVSS v3.0 base...

Information disclosure

Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Product ID by forcing victim to visit a specially crafted webpage for example, via clicking phishing link. Vulnerability has CVSS v3.0 base...

CVE-2019-8286

CVE-2019-8286 concerns Kaspersky URL Advisor in multiple Kaspersky products. The issue stems from how the URL Advisor injects a remotely-hosted JavaScript into pages, where the injected URL contained a unique, per-user identifier. This could allow websites or third-party services to read the Kasp...

Linux Kernel Flaw Allows Remote Code-Execution

Millions of Linux systems could be vulnerable to a high-impact race condition flaw in the Linux kernel. Kernel versions prior to 5.0.8 are affected by the vulnerability CVE-2019-11815, which exists in the rdstcpkillsock in net/rds/tcp.c. “There is a race condition leading to a use-after-free UAF,...