Security Updates for Microsoft Visual Studio Products (September 2019)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations. An attacker who...

.NET Core SDK Multiple Vulnerabilities (Sep 2019)

ASP.NET Core SDK is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:.netcoresdk";...

Microsoft SharePoint Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery CSRF. To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request. The...

Microsoft Exchange Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App OWA fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive...

ALPINE-CVE-2019-15892

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Servic...

Cisco UCS Director and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability

Cisco UCS Director and Cisco UCS Director Express for Big Data are both products from Cisco, Inc. Cisco UCS Director is a heterogeneous platform for private cloud Infrastructure as a Service IaaS. Cisco UCS Director is a heterogeneous platform for private cloud infrastructure-as-a-service IaaS. A...

CVE-2019-1900

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service DoS condition on an affected system. The vulnerability is due to insufficient validation of...

Microsoft Office SharePoint XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

The vulnerability in the web interface for managing Cisco Small Business Series 220 routers allows a perpetrator to execute arbitrary commands with root privileges.

The vulnerability in the web interface for managing Cisco Small Business Series 220 routers allows a perpetrator to execute arbitrary commands with root privileges by sending specially crafted HTTP or HTTPS requests depending on the device configuration...

The vulnerability in the web interface for managing Cisco Small Business Series 220 routers allows a perpetrator to write arbitrary files to the device’s file system.

The vulnerability of the Cisco Small Business Series 220 router management web interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system by sending specially crafted HTTP or HTTPS...

The vulnerability of the SSL VPN web portal of the operating system FortiOS, related to errors in the authentication mechanism of the web portal, allows a hacker to change the user password of the web portal.

The vulnerability of the SSL VPN web portal of the operating system FortiOS is related to errors in the authentication mechanism of the web portal. Exploiting this vulnerability allows a malicious actor to change the user password of the web portal through HTTP requests...

CVE-2019-1137

A cross-site-scripting XSS vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'...

CVE-2019-1134

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'...

CVE-2019-1083

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of Service Vulnerability'...

USN-4056-1 exiv2 vulnerabilities

It was discovered that Exiv2 incorrectly handled certain PSD files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-19107, CVE-2018-19108 It was discovered that Exiv2 incorrectly handled certain PNG files. An attacker could possibly use this issue to cause a denia...

Microsoft .NET Framework Denial of Service Vulnerability (CNVD-2019-22203)

Microsoft .NET Framework is a comprehensive and consistent programming model from Microsoft Corporation USA and a development platform. The platform includes the C and Visual Basic programming languages, a public language runtime library, and an extensive class library. A denial of service...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2019-22629)

Mozilla Firefox, commonly known as "Firefox" in Chinese, is a free and open-source web browser that uses the Gecko typography engine and supports a variety of operating systems, such as Windows, Mac OS X and GNU/Linux, among others. A denial of service vulnerability exists in Mozilla Firefox, whi...

Denial Of Service (DoS)

asp.net core is vulnerable to denial of service. Improper handling of web requests allow a remote attacker to crash the application...

Denial Of Service (DoS)

asp.net core is vulnerable to denial of service. A remote attacker is able to crash the application via malicious web requests...

The vulnerability of the Web interface of the Cisco Data Center Network Manager system allows a perpetrator to perform arbitrary actions on a vulnerable device with administrator privileges.

The vulnerability of the Web interface of the Cisco Data Center Network Manager DCNM system is related to session management errors. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device with administrator privileges, using specially crafted...