DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - The user's can set an existing password as a new password.

An application is allowing user to set new password same as that of the old password. Passwords are entirely user's responsibility but As the old password may be exposed to other users, depending on the security password policy application, it should not be possible to set a new password value...

CVE-2020-5860

On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability HA network failover in Device Service Cluster DSC, the failover service does not require a strong form of authentication and HA...

The vulnerability of the TempFileName parameter of the CGI script cgiRecvFile.exe in the Worry-Free Business Security antivirus protection system allows a hacker to read arbitrary files in the target system.

The vulnerability of the TempFileName parameter in the CGI executable cgiRecvFile.exe exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to read arbitrary files on the target system by sending specially crafted HTTP requests...

CVE-2019-6558

In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro Android App, the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak...

CVE-2019-6560

In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro Android App, the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak...

The vulnerability of the LOAD DATA LOCAL INFILE component in the mysql (mysqljs) Node.js software module allows a hacker to gain unauthorized access to protected information.

The vulnerability of the LOAD DATA LOCAL INFILE component in the mysql mysqljs Node.js software platform exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

Halvotec Information Services RAQuest Authorization Issues Vulnerability

Halvotec Information Services RAQuest is a suite of automated tax withholding software from Halvotec Information Services, Germany. An authorization issue vulnerability exists in Halvotec Information Services RAQuest version 10.23.10801.0. The vulnerability stems from a lack of authentication...

PT-2020-12167 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to delete a category via a crafted request to the admin/manage-categories.php endpoint. This is made possible by a CSRF weakness. Recommendations: For Chad...

CVE-2019-5134

An exploitable regular expression without anchors vulnerability exists in the Web-Based Management WBM authentication functionality of WAGO PFC200 versions 03.00.3912 and 03.01.0713, and WAGO PFC100 version 03.00.3912. A specially crafted authentication request can bypass regular expression...

Security Bulletin: IBM® Db2® does not explicitly forbid a weaker than expected 3DES cipher when configured to use SSL (CVE-2019-4102).

Summary TLS 1.2 allows the use of 3DES, which has some known weaknesses, among other supported ciphers. Db2 does not forbid the use of 3DES when configured to use TLS 1.2 protocol. Although Db2 does not choose the cipher out of all available ciphers, the weaker ciphers should be explicitly...

CVE-2020-9756

Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. The IOCTL Codes 0x80102050 and 0x80102054 allows a local user with low privileges to read/write 1/2/4 bytes from or to an IO port. This could be leveraged in a number of ways to ultimately run code with...

The vulnerability of the PRNG component of the FortiOS operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the PRNG component in the FortiOS operating system relates to the use of a weak entropy source during key generation. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information, when FortiOS acts as a client...

Hostapd Security Feature Issue Vulnerability

hostapd is a user space daemon for access points and authentication servers. A security signature issue vulnerability exists in versions of hostapd prior to 2.6 that stems from a lack of security measures such as authentication, access control, and privilege management in a networked system or...

The vulnerability of the WriteTIFFImage function in the program for reading and editing ImageMagick graphic files involves accessing confidential data beyond the buffer limit of memory. This allows attackers to gain access to sensitive information and cause system failures.

The vulnerability of the WriteTIFFImage function in the ImageMagick program, which is used for reading and editing graphic files, is related to the absence or incomplete cleaning of input data. Exploiting this vulnerability can allow a malicious actor to compromise data confidentiality, as well a...

PhpIX 2012 Professional - 'id' SQL Injection

Title: PhpIX 2012 Professional - 'id' SQL Injection Date: 2020-02-26 Author: indoushka Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit Vendor : http://www.allhandsmarketing.com/ poc : + Dorking İn Google Or Other Search Enggine. + /productdetail.php?id=448578 ====|...

Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A remote code execution vulnerability exists in the upgrade component of Cis...

ICSA-20-051-01_B&R Automation Studio and Automation Runtime

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: B&R Industrial Automation GmbH Equipment: Automation Studio and Automation Runtime Vulnerability: Improper Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability may allow a...

Weak SSH Cipher Suites

Communication with SSH servers using weak cipher suites might be prone to attacks trying to intercept secure communications...

chromium-browser: Insufficient policy enforcement in AppCache

Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

The vulnerability of the BI Workspace component of the SAP BusinessObjects Business Intelligence platform arises from deficiencies in the encryption of user-input data. This allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability of the BI Workspace component of the SAP BusinessObjects Business Intelligence platform exists due to deficiencies in the encryption of data entered by users. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...