openSUSE Security Update : openldap2 (openSUSE-2019-2157)

This update for openldap2 fixes the following issues : Security issue fixed : - CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption bsc1143194. - CVE-2019-13057: Fixed an issue with delegated database admin privileges bsc1143273. - CVE-2017-17740:...

OPENSUSE-SU-2019:2157-1 Security update for openldap2

This update for openldap2 fixes the following issues: Security issue fixed: - CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption bsc1143194. - CVE-2019-13057: Fixed an issue with delegated database admin privileges bsc1143273. - CVE-2017-17740: Wh...

CVE-2019-16097 Harbor privilege elevation vulnerability analysis-vulnerability warning-the black bar safety net

The Harbor is one for the storage and distribution Docker image of the enterprise Registry server, by adding some of the business functions necessary characteristics, such as security, identification, and management, the expansion of the open-source Docker Distribution. As an enterprise-level...

CVE-2019-11326

An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same...

SUSE SLED15 / SLES15 Security Update : openldap2 (SUSE-SU-2019:2395-1)

This update for openldap2 fixes the following issues : Security issue fixed : CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption bsc1143194. CVE-2019-13057: Fixed an issue with delegated database admin privileges bsc1143273. CVE-2017-17740: When...

SUSE-SU-2019:2395-1 Security update for openldap2

This update for openldap2 fixes the following issues: Security issue fixed: - CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption bsc1143194. - CVE-2019-13057: Fixed an issue with delegated database admin privileges bsc1143273. - CVE-2017-17740: Wh...

CVE-2019-13922

A vulnerability has been identified in SINEMA Remote Connect Server All versions V2.0 SP1. An attacker with administrative privileges can obtain the hash of a connected device's password. The security vulnerability could be exploited by an attacker with network access to the SINEMA Remote Connect...

Unspecified Vulnerability in Siemens SINEMA Remote Connect Server

Siemens SINEMA Remote Connect Server is a server application. SINEMA Remote Connect allows users to access remote equipment or machines so that maintenance can be performed easily and safely. An unspecified vulnerability exists in Siemens SINEMA Remote Connect Server. An attacker with...

Design/Logic Flaw

On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges...

The vulnerability in the web interface for managing physical infrastructure and virtual environments of Cisco UCS Director and Cisco UCS Director Express for Big Data allows a attacker to bypass authentication procedures and execute arbitrary code.

The vulnerability in the web-based interfaces for managing physical infrastructure and virtual environments of Cisco UCS Director and Cisco UCS Director Express for Big Data is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass...

The vulnerability affects the web interface for controlling the Cisco Integrated Management Controller (IMC) Supervisor, as well as tools for managing physical infrastructure and virtual environments like Cisco UCS Director and Cisco UCS Director Express for Big Data. This allows attackers to gain access to target systems with administrator privileges.

The vulnerability of the Cisco Integrated Management Controller IMC Supervisor web interface, as well as the tools for managing physical infrastructure and virtual environments like Cisco UCS Director and Cisco UCS Director Express for Big Data, is related to authentication procedures that have...

File Upload Vulnerability in OKLite Backend

OKLite is a set of minimalist enterprise station system, the main target group is the display of enterprise website users, so that traditional small businesses quickly deploy the site, strengthen their brand awareness, to achieve the publicity of the company's image. There is a file upload...

Remote Code Execution (RCE)

magento/community-edition is vulnerable to remote code execution RCE. The vulnerability exists as a user with admin privileges to email templates can execute arbitrary code by previewing a malicious template...

Arbitrary File Upload

magento/community-edition is vulnerable to arbitrary file upload. The vulnerability exists as a file upload filter bypass exists that allows users with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious upload and execution of...

osTicket < 1.10.2 XSS Vulnerability

osTicket is prone to a cross-site scripting XSS vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

Cisco Catalyst 3850 Series Device Manager Cross-Site Request Forgery

Cisco Catalyst 3850 Series are all different series of switching devices from Cisco USA. Cisco Catalyst 3850 Series Device Manager cross-site request forgery can be exploited by an attacker to perform an operation using the administrative privileges of a logged-in user accessing a malicious Web...

CVE-2019-7942

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates...

CVE-2019-7932

A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary P...

CVE-2019-7932

A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary P...

CVE-2019-7923

A server-side request forgery SSRF vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code...