CVE-2019-4412

IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162659...

IBM Cognos Controller Information Disclosure Vulnerability (CNVD-2019-39356)

IBM Cognos Controller is a suite of business intelligence and planning solutions from IBM in the United States. The product features process automation, financial audit control, and the creation and management of financial reports. An information disclosure vulnerability exists in IBM Cognos...

IBM Cloud Orchestrator Information Disclosure Vulnerability (CNVD-2019-39203)

IBM Cloud Orchestrator is a suite of cloud management solutions from IBM in the United States. The program provides extended internal and external deployment of cloud services and application program interfaces and tools to extend the integration with existing environments and other functions. An...

DEBIAN-CVE-2019-18348

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...

Unspecified Vulnerability in CloudBees Jenkins Rundeck Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Rundeck Plugin is used in one of the...

PT-2019-15379 · Xiaomi · Xiaomi Mi Wifi R3G

Name of the Vulnerable Software and Affected Versions: Xiaomi Mi WiFi R3G versions prior to 2.28.23-stable Description: An issue was discovered where the backup file in tar.gz format can be manipulated to control the contents of the decompressed directory. Additionally, a command injection...

Unspecified Vulnerability in CloudBees Jenkins Oracle Cloud Infrastructure Compute Classic Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed execution of the task.Oracle Cloud Infrastructure...

PT-2019-14892 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions up to 4.5.7 Description: The issue arises from the file appcontactscontact addresses.php using an unsanitized id variable from the URL, which is then reflected in HTML. This leads to a cross-site scripting XSS issue, allowi...

OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

The vulnerability of the `net/url` function in the Go programming language allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service interruptions.

The vulnerability of the net/url function in the Go programming language is related to an error in processing constructed path names in URL addresses, which leads to authentication bypass. Exploiting this vulnerability allows an attacker to compromise data integrity, gain unauthorized access to...

AZL-7399 CVE-2019-17414 affecting package vino 3.22.0-20

tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service "vngetstring error: Resource temporarily unavailable" error and daemon crash via a long URL...

Multiple vulnerabilities exist in the my_parse_url function of the MOXA EDR-810 industrial router’s web server. These vulnerabilities allow attackers to execute arbitrary code.

The multiple vulnerabilities of the myparseurl function offset 0x16748 in the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router are caused by a lack of checking data size when copying data into a buffer of 0x80 bytes. Exploitation of this vulnerability allows a...

The vulnerability of the LibreLogo software module of the LibreOffice office software package allows a hacker to execute arbitrary code on the target system.

The vulnerability of the LibreLogo software module in the LibreOffice office software package stems from errors in URL processing. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code on the target system using a specially crafted request...

CVE-2019-6837

A Server-Side Request Forgery SSRF: CWE-918 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could cause server...

PT-2019-12379 · Hrworks · Hrworks

Name of the Vulnerable Software and Affected Versions: HRworks version 1.16.1 Description: A reflected Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component. This can be achieved by manipulating the URL to includ...

The vulnerability of the LibreLogo software module of the LibreOffice office software package allows a hacker to execute arbitrary code on the target system.

The vulnerability of the LibreLogo software module in the LibreOffice office software package arises from errors in URL processing. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code on the target system using a specially crafted file...

The vulnerability in the web interface of Cisco Webex Meetings Server’s software for web conferencing allows a hacker to redirect users to a malicious website.

The vulnerability of the Cisco Webex Meetings Server web interface management software is related to errors in checking input parameters of the URL address in HTTP requests. Exploiting this vulnerability can allow a malicious actor to redirect users to a malicious website remotely...

OpenJDK: Missing URL format validation (Networking, 8221518)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access v...

Adwind Spyware-as-a-Service Attacks Utility Grid Operators

A phishing campaign that spoofs a PDF attachment to deliver Adwind spyware has been taking aim at national grid utilities infrastructure. Adwind, a.k.a. JRAT or SockRat, is being used in a malware-as-a-service model in this campaign, researchers said. It offers a full cadre of info-gathering...

DEBIAN-CVE-2019-9850

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on...