CVE-2019-4241

IBM PureApplication System versions 2.2.3.0–2.2.5.3 are affected by CVE-2019-4241, which allows an authenticated user with local access to bypass authentication and obtain administrative access. The vulnerability is documented across multiple sources (including NVD/NVDC and IBM advisories). Remed...

Cisco Integrated Management Controller Buffer Overflow Vulnerability

Cisco Integrated Management Controller IMC is a set of software from the American company Cisco Cisco for the management of UCS Unified Computing System. The software supports HTTP, SSH access, etc., and can perform operations such as powering on, powering off and rebooting the server. A buffer...

Securifi Almond Cross-Site Scripting Vulnerability (CNVD-2019-18748)

The Securifi Almond is a wireless router with a touch screen. A cross-site scripting vulnerability in the Securifi Almond, Almond+, and Almond 2015 using firmware version AL-R096, which stems from the program's failure to implement an arbitrary cross-site scripting protection mechanism, can be...

libvirt security update

5.0.0-4.el7 - logging: restrict sockets to mode 0600 Daniel P. Berrange Orabug: 29861433 CVE-2019-10132 - locking: restrict sockets to mode 0600 Daniel P. Berrange Orabug: 29861433 CVE-2019-10132 - admin: reject clients unless their UID matches the current UID Daniel P. Berrange Orabug: 29861433...

CVE-2019-0307

Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to t...

CVE-2019-12274

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

CVE-2019-12274

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

Code injection

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

CVE-2019-12274

CVE-2019-12274 affects Rancher 1 and 2 up to 2.2.3. Unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane by posting data via node driver options, enabling reading of sensitive files such as /root/.kube/config or /var/lib/rancher/management-state/cr...

PT-2019-12727 · Rancher · Rancher

Name of the Vulnerable Software and Affected Versions: Rancher versions 1 through 2.2.3 Rancher versions 2 through 2.2.3 Description: The issue allows unprivileged users to gain admin access to the Rancher management plane by posting sensitive data to the cloud. This can be achieved by exploiting...

CVE-2019-12502

There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI...

Percona Server Authorization Issues Vulnerability

Percona Server is an open source relational database management system . An authorization issue vulnerability exists in Percona Server version 5.6.44-85.0-1 Debian and Ubuntu. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a networked...

WordPress WaspThemes Visual CSS Style Editor Plugin < 7.2.1 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-12239

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access...

CVE-2019-12239

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access...

PT-2019-12710 · WordPress · Wp Booking System

Name of the Vulnerable Software and Affected Versions: WP Booking System plugin version 1.5.1 Description: The issue is related to the lack of CSRF protection, which can allow attackers to exploit certain SQL injection issues that require administrative access. Recommendations: For WP Booking...

Microsoft Edge Permission License and Access Control Issues Vulnerability

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A vulnerability exists in Microsoft Edge for privilege permission and access control issues. The vulnerability stems from a lack of effective privilege-granting and access-control measure...

CVE-2019-11886

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...

Cross site request forgery (csrf)

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...

CVE-2019-11886

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...