CVE-2019-15749

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account e.g., via XSS or an unattended workstation to change that password and...

Moodle Authorization Issues Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. An authorization issue vulnerability exists in Moodle, which can be exploited by an attacker to gain access to the Teacher role...

CVE-2019-10990

Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files...

CVE-2019-14826

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session...

CVE-2019-16227

An issue was discovered in py-lmdb 0.97. For certain values of mnflags, mdbcursorset triggers a memcpy with an invalid write operation within mdbxcursorinit1. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker...

ASUS SmartHome Access Control Error Vulnerability

ASUS SmartHome is a smart home control and management application from Asus Taiwan, China. A security vulnerability exists in ASUS SmartHome 3.0.42190515 and later Android and 2.0.22 and earlier iOS. The vulnerability can be exploited by an attacker with the http://target/smarthome/devicecontrol...

Lenovo XClarity Administrator Cross-Site Scripting Vulnerability

Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The product is capable of providing agentless hardware management for servers, storage, network switches, and more. A cross-site scripting vulnerability exists in Lenovo XClarity Administrator. An...

WTF Authorization Problem Vulnerability

WTF is an open source terminal-based dashboard utility program. The program supports monitoring system, service and other information. WTF is vulnerable to an authorization issue. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a networked...

Google Android Information Disclosure Vulnerability (CNVD-2019-38547)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in System in Android. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker could...

Google Android Information Disclosure Vulnerability (CNVD-2019-28863)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. System in Android Q suffers from an information disclosure vulnerability. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker...

Adobe Creative Cloud Desktop Application Insecure Transfer of Sensitive Data Vulnerability

Adobe Creative Cloud Desktop Application is the management software for various Creative Cloud applications and services. An insecure transmission of sensitive data vulnerability exists in Adobe Creative Cloud Desktop Application 4.6.1 and earlier versions. An attacker could exploit this...

CVE-2019-0333

In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform Web Intelligence, versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information...

mysql: Server: FTS unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: FTS. Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

The vulnerability of the information protection tool against unauthorized access—Akord-Win64—allows a intruder to gain access to confidential information.

The vulnerability of the Akord-Win64 information protection tool against unauthorized access is related to deficiencies in security mechanisms when working with hidden files and directories. Exploiting this vulnerability could allow a malicious actor, operating locally, to gain access to...

Firecoin Wallet App Has Information Leakage Vulnerability

Firecoin Wallet is a professional multi-currency wallet, relying on the technical strength of Firecoin Group to provide convenient and reliable digital asset management services. There is an information leakage vulnerability in Firecoin Wallet APP, which can be exploited by attackers to obtain...

Logitech Unifying Device Information Disclosure Vulnerability (CNVD-2019-34836)

Logitech Unifying is a USB type signal receiver from Logitech, Switzerland. An information disclosure vulnerability exists in the Logitech Unifying device. An attacker could exploit the vulnerability to obtain sensitive information about an affected component...

WordPress Plugin Live Chat Unlimited Cross-Site Scripting Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site scripting vulnerability exists in the WordPress plugin Live Chat Unlimited,...

CVE-2019-4385

IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...

CVE-2019-0314

SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

Design/Logic Flaw

Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server...