CVE-2019-17598

CVE-2019-17598 affects Lightbend Play Framework (2.5.x–2.6.23) and its play-ws component. When configured to proxy requests through an authenticated HTTP proxy, under high load, HTTPS connections to a target host may reveal proxy credentials to that host. Impact is information disclosure; details...

JetBrains TeamCity Cross-Site Scripting Vulnerability (CNVD-2019-39176)

TeamCity is a Java-based build management and continuous integration server from JetBrains. A cross-site scripting vulnerability exists in JetBrains TeamCity 2019.1, 2019.1.1. An attacker can exploit this vulnerability to send arbitrary HTTP requests to the TeamCity server in the name of the...

PT-2019-11643 · Fat Free Crm · Fat Free Crm

Name of the Vulnerable Software and Affected Versions: Fat Free CRM version 0.19.0 Description: A HTML Injection issue has been reported in the Fat Free CRM product, specifically via an authenticated request to the "/comments" URI. The vendor disputes the significance of this report, citing that...

PT-2019-5257

Name of the Vulnerable Software and Affected Versions Atlassian Crowd versions 2.1.0 through 3.0.4 Atlassian Crowd versions 3.1.0 through 3.1.5 Atlassian Crowd versions 3.2.0 through 3.2.7 Atlassian Crowd versions 3.3.0 through 3.3.4 Atlassian Crowd versions 3.4.0 through 3.4.3 Atlassian Crowd Da...

CVE-2018-19981

Amazon AWS SDK =2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege...

PT-2019-8044 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub 2245-222 version 1012 Description: A buffer overflow issue exists in the PubNub message handler. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow, overwriting arbitrary data. An...

PT-2019-8045 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub 2245-222 version 1012 Description: A buffer overflow vulnerability exists in the PubNub message handler. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow, overwriting arbitrary dat...

CVE-2017-14443

An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number of GET parameters supplied, leading to an arbitrarily controlled information leak on the whole device memory. An attacker can send an...

Insteon Hub Buffer Overflow Vulnerability (CNVD-2018-14864)

The Insteon Hub is an Insteon central controller product from Insteon USA. This product can remotely control light bulbs, wall switches, air conditioners and more in your home. A buffer overflow vulnerability exists in the Insteon Hub using firmware version 1012. An attacker could exploit the...

Insteon Hub Buffer Overflow Vulnerability (CNVD-2018-14866)

The Insteon Hub is an Insteon central controller product from Insteon USA. This product can remotely control light bulbs, wall switches, air conditioners and more in your home. A buffer overflow vulnerability exists in the Insteon Hub using firmware version 1012. An attacker could exploit the...

Insteon Hub Buffer Overflow Vulnerability (CNVD-2018-14862)

The Insteon Hub is an Insteon central controller product from Insteon USA. This product can remotely control light bulbs, wall switches, air conditioners and more in your home. A buffer overflow vulnerability exists in the Insteon Hub using firmware version 1012. An attacker could exploit the...

Insteon Hub Buffer Overflow Vulnerability (CNVD-2018-14863)

The Insteon Hub is an Insteon central controller product from Insteon USA. This product can remotely control light bulbs, wall switches, air conditioners and more in your home. A buffer overflow vulnerability exists in the Insteon Hub using firmware version 1012. An attacker could exploit the...

PT-2018-6263 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub 2245-222 version 1012 Description: The issue arises from specially crafted commands sent through the PubNub service, which can cause a stack-based buffer overflow, overwriting arbitrary data. This is triggered by sending an...

PT-2018-6275 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, the s mac key value is copied to a 25-byte buffer using strcpy. Sending a value longer than 2...

PT-2018-6272 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, the value for the s vol brt delta key is copied using strcpy to a buffer at address 0xa000051...

PT-2018-6278 · Sap · Sap Bpc

Name of the Vulnerable Software and Affected Versions: SAP BPC affected versions not specified Description: The issue concerns an XML external entity vulnerability in the reporting functionality. It can be triggered by a specially crafted XML request, leading to information disclosure and potenti...

CVE-2016-10549

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests ...

Cloud Foundry BOSH CLI Access Control Error Vulnerability

Cloud Foundry CF is a set of open source Platform-as-a-Service PaaS cloud computing platforms from the U.S.-based Cloud Foundry Foundation, which provides container scheduling, continuous delivery, and automated service deployment.BOSH CLI is one of the command-line tools. An access control error...

Improper access control

Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. A user with access to an instance using the BOSH CLI can access the BOSH CLI configuration file and use its contents to perform authenticated requests to BOSH...

CVE-2018-6224

A lack of cross-site request forgery CSRF protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticated requests to a user browsing an attacker-controlled domain...