Silver Peak Systems EdgeConnect SD-WAN Information Disclosure Vulnerability

Silver Peak Systems EdgeConnect SD-WAN is a suite of software-defined, wide-area networking platforms from Silver Peak Systems, USA. The platform provides path conditioning, application classification, routing and virtual WAN overlay. A security vulnerability exists in Silver Peak Systems...

CentOS Web Panel elevation of privilege vulnerability (CNVD-2019-32249)

Control Web Panel is a Linux web hosting control panel. An elevation of privilege vulnerability exists in Control Web Panel, which can be exploited by an attacker to upload malicious software using the REST API...

Denial of Service Vulnerability in MOXA EDS-405A Industrial Switch

The EDS-405A/408A series are 5-port and 8-port entry-level managed Ethernet switches designed for industrial applications. A denial-of-service vulnerability exists in the MOXA EDS-405A industrial switches, which can be exploited by an attacker to construct a special data message that can cause th...

CVE-2019-0345

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

CVE-2019-0345

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

OSIsoft PI Cross-Site Request Forgery Vulnerability

OSIsoft PI is a set of commercialized software application platform based on Ckient/Server structure from OSIsoft, USA. The platform supports data acquisition, analysis and visualization. A cross-site request forgery vulnerability exists in the OSIsoft PI Web API 2018 and prior versions, which ca...

User Agent String Switcher Service - XSS Vulnerabilities

Document Title: =============== User Agent String Switcher Service - XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2189 Release Date: ============= 2019-08-13 Vulnerability Laboratory ID VL-ID: ====================================...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2019-1266)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

PT-2019-4196

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java versions 7.30 through 7.50 Description A remote unauthenticated attacker can exploit a web service in the SAP NetWeaver Application Server for Java by sending a specially crafted XML file. This can tri...

Information disclosure

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP reques...

CVE-2019-7951

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP reques...

CVE-2019-7951: Undefined Security Weakness

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP reques...

PT-2019-18848

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An information leakage issue exists due to improper access control parameter enforcement in a SOAP web service endpoint...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services is affected by a potential SQL Injection vulnerability (CVE-2019-4032)

Summary IBM Financial Transaction Manager for Corporate Payment Services FTM CPS for Multi-Platform has addressed the following vulnerability. A potential Blind SQL injection on a web service. Vulnerability Details CVEID: CVE-2019-4032 DESCRIPTION: IBM Financial Transaction Manager for Digital...

Moodle Filepicker 3.5.2 Server-Side Request Forgery

Exploit Title: Server Side Request Forgery in Moodle Filepicker Google Dork: / Date: 2019-07-25 Exploit Author: Fabian Mosch & Nick Theisinger r-tec IT Security GmbH Vendor Homepage: https://moodle.org/ Software Link: https://github.com/moodle/moodle Version: Moodle Versions 3.4, 3.3, 3.3.3, 3.2 ...

CVE-2019-2742

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Whil...

CVE-2019-2742

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Whil...

Design/Logic Flaw

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access v...

Code injection

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Utilities. Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

Design/Logic Flaw

Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware subcomponent: Web Service API. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Whil...