CVE-2019-1010112

OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery CSRF. The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3...

Pluck Code Issue Vulnerability

Pluck is a content management system CMS developed using the PHP language. A code issue vulnerability exists in the data/inc/images.php file in Pluck 4.7.4 and earlier versions. The vulnerability stems from an improperly designed or implemented code development process for a web-based system or...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability

SAP BusinessObjects Business Intelligence platform is a suite of bookstore intelligence software and enterprise performance solutions from SAP Germany. The product features report generation, analytics and data visualization. A cross-site scripting vulnerability in the SAP BusinessObjects Busines...

UBUNTU-CVE-2019-10191

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol...

ALPINE-CVE-2019-13345

The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...

DEBIAN-CVE-2019-13345

The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...

CVE-2019-13243

IrfanView 4.52 has a User Mode Write AV starting at image00400000+0x00000000000249c6...

PT-2019-13238 · Xpdf · Xpdf

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.01.01 Description: The issue is a heap-based buffer over-read in the JBIG2Stream::readTextRegionSeg function, which can be triggered by sending a crafted PDF document to the pdftoppm tool. This might allow an attacker to cause...

PT-2019-2936

Name of the Vulnerable Software and Affected Versions lodash versions prior to 4.17.12 Description The issue is related to the defaultsDeep function in the lodash library, which can be tricked into adding or modifying properties of Object.prototype using a constructor payload. This is due to...

mxGraph Cross-Site Scripting Vulnerability

mxGraph is a JavaScript charting library . A cross-site scripting vulnerability exists in mxGraph 4.0.0 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute client-side code...

UBUNTU-CVE-2019-12982

Ming aka libming 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SWF file...

ALPINE-CVE-2019-12435

Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management server dnsserver RPC server process...

FusionPBX Operator Panel module cross-site scripting vulnerability (CNVD-2019-40060)

FusionPBX is a scalable, multi-threaded communication platform. The platform can be used as a call center server, fax server, voip server, voicemail server, conference server and voice application server, etc. Operator Panel module is one of the operator panel modules. The platform can be used as...

Samsung Galaxy Apps Trust Management Issue Vulnerability

Samsung Galaxy Apps is a pre-installed application store program for Samsung mobile devices from Samsung South Korea. A security vulnerability exists in Samsung Galaxy Apps versions prior to 4.4.01.7. An attacker can exploit the vulnerability to modify the hostname to mimic the app store's API,...

Intel Unite Client Elevation of Privilege Vulnerability

Intel UniteR Client is a conferencing client from Intel Corporation. A security vulnerability exists in Intel UniteR Client versions prior to 4.0. An attacker could exploit the vulnerability to elevate privileges...

CVE-2019-0287

Under certain conditions SAP BusinessObjects Business Intelligence platform Central Management Server, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2018-12299

Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names...

Aiwo Real Estate System v4.7 Information Disclosure Vulnerability

Sticky Cat is an extremely light, minimalist general-purpose PHP website system. AiWo Real Estate System v4.7 has information leakage vulnerability, attackers can use the vulnerability to obtain database information...

Aiwo Real Estate System v4.7 has Arbitrary File Download Vulnerability

Sticky Cat is an extremely light, minimalist general-purpose PHP website system. Aiwo Real Estate System v4.7 has an arbitrary file download vulnerability that can be exploited by attackers to download arbitrary files...

File Upload Vulnerability in Aiwo Real Estate System v4.7

Intimate cat imcat is an extremely light, minimalist general-purpose PHP website system. File upload vulnerability exists in Aiwo Real Estate System v4.7, which can be exploited by attackers to upload malicious code and gain server privileges...