CVE-2019-4572

IBM FileNet Content Manager 5.5.2 and 5.5.3 (in specific configurations) could log web service user credentials to local logs, exposing credentials to local administrators. The IBM bulletin (Security Bulletin: IBM FileNet Content Manager and Case Foundation security vulnerability in Process Orche...

Security Bulletin: IBM FileNet Content Manager and Case Foundation security vulnerability in Process Orchestration Web Service logging

Summary A security vulnerability in IBM FileNet Content Manager and Case Foundation, in some case, could contain user information in the log when Process Orchestration Web Services is invoked. Vulnerability Details CVEID: CVE-2019-4572 DESCRIPTION: IBM FileNet Content Manager in specific...

Exploit for Incorrect Default Permissions in Kramerav Viaware

Exploit Title: KRAMER VIAware 2.5.0719.1034 - Remote Code Exec...

CVE-2018-2798

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-17217

An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service...

Default configuration

An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the web service...

Cross site request forgery (csrf)

An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service...

CVE-2019-17217

CVE-2019-17217 concerns the V-Zug Combi-Steam MSLQ line. The connected documents confirm a CSRF vulnerability in the device’s web service present on firmware older than Ethernet R07 and WLAN R05. The issue arises from the web interface not properly protecting against CSRF, enabling an attacker to...

CVE-2019-17218

The CVE-2019-17218 entry concerns V-Zug Combi-Steam MSLQ devices prior to Ethernet R07 and WLAN R05, where web service communications occur over unencrypted HTTP by default. This configuration enables an attacker to intercept and sniff traffic between the device and the web service, exposing pote...

CVE-2019-17218

An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the web service...

PT-2019-15010

Name of the Vulnerable Software and Affected Versions V-Zug Combi-Steam MSLQ devices versions before Ethernet R07 and before WLAN R05 Description An issue was discovered where there is no CSRF protection established on the web service, potentially allowing for unauthorized actions. Recommendation...

CVE-2019-17217: Cross-Site Request Forgery (CSRF)

An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service...

PT-2019-15011

Name of the Vulnerable Software and Affected Versions V-Zug Combi-Steam MSLQ devices versions before Ethernet R07 and before WLAN R05 Description An issue was discovered where communication to the web service is unencrypted via http by default. This allows an attacker to intercept and sniff...

VulnCheck KEV: CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users...

CryptonDie - A Ransomware Developed For Study Purposes

CryptonDie is a ransomware developed for study purposes. Options --key key used to encrypt and decrypt files, default is random stringrecommended --dir Home directory for the attack, default is / --encrypt Encrypt all files --decrypt Decrypt all files --verbose Active verbose mode, default is Fal...

CVE-2019-13467

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

CVE-2019-13467

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

CVE-2019-13467: Undefined Security Weakness

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

Moxa MGate Embedded Web Server Code Execution

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 lies in a buffer overflow issue during the processing of input data in the SysChallenge parameter. Exploiting this vulnerability allows an attacker to...

Progress Software MOVEit Transfer SQL Injection Vulnerability

Progress Software MOVEit Transfer is an automated file transfer software from Progress Software, USA. The software supports file transfer and provides file transfer activity monitoring. A SQL injection vulnerability exists in the MOVEit.DMZ.WebApi.dll file in Progress Software MOVEit Transfer,...