PT-2019-11997

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2019.0.3 Puppet Enterprise versions prior to 2018.1.9 Description The express install of Puppet Enterprise provides a URL to set the admin password at the end of the installation. However, if this URL is not...

DEBIAN-CVE-2019-18346

A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user...

TP-LINK TL-WR841N Web Service http_parser_main Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Hos...

Apache Airflow vulnerable to XSS and local file disclosure

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...

GHSA-Q3P4-GW7R-WQJC Apache Airflow vulnerable to XSS and local file disclosure

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...

Yoti: Multiple Vulnerabilities in (*www.yoti.com) - Leads to Leakage user admin Sensitive Exposure

Sumarry Hi! Team @yoti, We Found Multiple Vulnerabilities in you websites , Username Admin Login Sensitive Exposure All Sensitive Exposure Using Shodan Platforms Affected: website . https://185.116.54.11/wp-json . https://185.116.54.11/wp-json/wp/v2/users POC Supporting Material/References...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18649

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18649

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18646

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

Cross site scripting

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18646

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18648

CVE-2019-18648 affects Untangle NG firewall 14.2.0 with a reflected XSS vulnerability exploitable when an administrator is logged in. The weakness is reported at multiple input fields and other input points, enabling injection of malicious scripts via user-supplied data. The provided documents in...

CVE-2019-18649

The CVE-2019-18649 entry concerns Untangle NG firewall 14.2.0 where an admin-authenticated user can trigger a stored XSS in the Title input under Reports. Documented impact metrics include CVSS v2 base score 3.5 (LOW) and CVSS v3.1 base score 4.8 (MEDIUM); both indicate potential confidentiality/...

PT-2019-15552

Name of the Vulnerable Software and Affected Versions Untangle NG Firewall version 14.2.0 Description The issue concerns a stored XSS vulnerability in the Title input field under Reports when an admin user is logged in. Recommendations For Untangle NG Firewall version 14.2.0, update to a version...

CVE-2019-18649: Improper Neutralization of Input During Web Page Generation

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18648: Improper Neutralization of Input During Web Page Generation

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

PT-2019-15551

Name of the Vulnerable Software and Affected Versions Untangle NG Firewall version 14.2.0 Description The issue allows for reflected XSS attacks when logged in as an admin user, affecting multiple places and specific user input fields. Recommendations For Untangle NG Firewall version 14.2.0,...