CVE-2019-9678

Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X fo...

PT-2019-4779 · Openconnect +3 · Openconnect +3

Name of the Vulnerable Software and Affected Versions: OpenConnect versions prior to 8.05 Description: The issue is related to a buffer overflow in the process http response function when handling HTTP chunked encoding with crafted chunk sizes. This could allow a remote attacker to gain...

Google Chrome has multiple file download vulnerabilities

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 77.0.3865.75. A remote attacker can exploit the vulnerability to bypass file download protection with the help of a specially crafted website...

PT-2019-18368 · Schneider Electric · Modicon M580

Name of the Vulnerable Software and Affected Versions: Modicon M580 versions prior to V2.80 Description: A vulnerability exists that could cause a possible denial of service when sending an appropriately timed HTTP request to the controller. This issue is related to an uncaught exception...

Atlassian Jira Information Disclosure Vulnerability (CNVD-2019-32344)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in AccessLogFilter in Atlassian Jira versions prior to 8.4.0, which can be...

Google Chrome CSRF Bypass Vulnerability

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 77.0.3865.75. A remote attacker can exploit the vulnerability with the help of a specially crafted website to bypass security restrictions and gain unauthorized acce...

SPIP Input Validation Error Vulnerability

SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. An input validation error vulnerability exists in SPIP versions prior to 3.1.11 and 3.2.2 prior to 3.2.5, which arises from a web-based system or product that does not properly validate incoming...

DEBIAN-CVE-2019-16370

The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...

CVE-2019-13918

A vulnerability has been identified in SINEMA Remote Connect Server All versions V2.0 SP1. The web interface has no means to prevent password guessing attacks. The vulnerability could be exploited by an attacker with network access to the vulnerable software, requiring no privileges and no user...

PT-2019-7746 · Headway · Headway

Name of the Vulnerable Software and Affected Versions: Headway theme versions prior to 3.8.9 Description: The issue concerns a Cross-Site Scripting XSS flaw. This type of flaw occurs when an application includes user input in its output without proper validation or encoding, allowing an attacker ...

PT-2019-5216 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a Server Side Request Forgery SSRF vulnerability. This occurs because URL validation does not consider the interpretation of a name as a series of hex characters...

PT-2019-14542 · Gophish · Gophish

Name of the Vulnerable Software and Affected Versions: Gophish versions prior to 0.8.1 Description: The issue allows for XSS via a username. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

WordPress affiliates-manager plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. affiliates-manager is an e-commerce marketing plugin used in it. A cross-site request forgery vulnerability exists in versions of the...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2019-30447)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox versions prior to 69, which can be exploited by remote attackers to execute scripts in a user's browser...

Mozilla Firefox Resource Management Error Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A resource management error vulnerability exists in Mozilla Firefox versions prior to 69, which can be exploited by attackers to execute arbitrary code or cause a denial of service...

UBUNTU-CVE-2019-11734

Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 69...

CVE-2019-15898

Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page...

PT-2019-18009 · Lenovo · Lenovo Xclarity Administrator

Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator versions prior to 2.5.0 Description: A reflected cross-site scripting issue was reported that could allow a crafted URL to cause JavaScript code to be executed in the user's web browser. The JavaScript code is no...

WordPress wp-ultimate-recipe plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-ultimate-recipe is a plugin for inserting recipes into web pages. A cross-site scripting vulnerability exists in WordPress...

UBUNTU-CVE-2019-11248

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for...