14619 matches found
CVE-2019-6113
Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to read arbitrary files via a .. dot dot and %2f to the default URI...
CVE-2019-6113
CVE-2019-6113 affects ONKYO TX-NR686 series A/V Receivers. The vulnerability is a directory traversal in the device’s URI handling that allows remote attackers to read arbitrary files by supplying a ../ sequence and %2f in the default URI. Documented impact indicates partial confidentiality impac...
Cisco UCS Director Authentication Bypass (cisco-sa-20190821-imcs-ucs-authby)
According to its self-reported version, the remote host is running a version of Cisco UCS Director that is affected by an authentication bypass vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary actions with administrative privileges...
SQL injection vulnerability in ask2 Q&A system backend (CNVD-2019-30155)
ASK2 Q&A is an open source PHP Q&A program. There is a SQL injection vulnerability in the backend of ask2 Q&A System, which can be exploited by attackers to obtain sensitive information about the database...
CVE-2019-2130
In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation. Product:...
Out-of-bounds
In MfcTransceive of phNxpExtnsMifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...
Privilege escalation
An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2...
Design/Logic Flaw
In the endCall function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of access to Emergency Services with User execution privileges needed. User interaction is not needed for exploitation. Product: Android...
Heap overflow
In MfcTransceive of phNxpExtnsMifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...
CVE-2019-2137
In the endCall function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of access to Emergency Services with User execution privileges needed. User interaction is not needed for exploitation. Product: Android...
CVE-2019-2133
In MfcTransceive of phNxpExtnsMifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...
How to Prepare for Misconfigurations Clouding the Corporate Skies
Cloud-based storage and infrastructure provides myriad benefits for any organization, like letting them avoid the costs of expensive hardware and granting them quick access to infrastructure as needed. Companies can use cloud services for minutes or years, depending on their needs. However, there...
Adwind Spyware-as-a-Service Attacks Utility Grid Operators
A phishing campaign that spoofs a PDF attachment to deliver Adwind spyware has been taking aim at national grid utilities infrastructure. Adwind, a.k.a. JRAT or SockRat, is being used in a malware-as-a-service model in this campaign, researchers said. It offers a full cadre of info-gathering...
Webmin 1.920 - Remote Code Execution
Webmin 1.920 - Remote Code Execution !/bin/sh CVE-2019-15107 Webmin Unauhenticated Remote Command Execution based on Metasploit module https://www.exploit-db.com/exploits/47230 Original advisory: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html...
Webmin 1.920 - Remote Code Execution
!/bin/sh CVE-2019-15107 Webmin Unauhenticated Remote Command Execution based on Metasploit module https://www.exploit-db.com/exploits/47230 Original advisory: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html Alternative advisory spanish:...
CVE-2019-9012
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.2...
DrMITM - Program Designed To Globally Log All Traffic Of A Website
DrMITM is a program designed to globally log all traffic. How it works DrMITM sends a request to website and returns the IP of the website just in case the server of the website is designed to rely on the website IP for requests, and the request that goes to the website also ends up being sent to...
CVE-2019-14659
This CVE entry is rejected/not used and does not represent an active vulnerability entry.
CVE-2019-5863
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...