PT-2019-18069

Name of the Vulnerable Software and Affected Versions ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description The issue is related to an Incorrect Access Control problem. It can be exploited via the "cgi-bin/webproc?getpage=html/index.html&subpage=wlsecurity" URI, allowing a...

CVE-2019-6282: Cross-Site Request Forgery (CSRF)

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password...

CVE-2018-14575

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...

CVE-2018-14575

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...

CVE-2018-20212

CVE-2018-20212 affects TWiki 6.0.2, specifically the bin/statistics component, where the webs parameter enables cross-site scripting (XSS). The vulnerability is described as a parameter-based XSS in TWiki/bin/statistics, with CVSS vectors indicating network attack, low to moderate complexity, and...

PT-2019-18591

Name of the Vulnerable Software and Affected Versions Ericsson Active Library Explorer ALEX version 14.3 Description A security issue exists in the software, where an XSS issue is present in multiple parameters of the "/cgi-bin/alexserv" servlet. The affected parameters include DB, FN, fn, and id...

CVE-2018-20212: Improper Neutralization of Input During Web Page Generation

bin/statistics in TWiki 6.0.2 allows cross-site scripting XSS via the webs parameter...

PT-2019-9038

Name of the Vulnerable Software and Affected Versions Trash Bin plugin version 1.1.3 for MyBB Description The issue concerns cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. The XSS vulnerability can be triggered via a thread subject, while the CSRF vulnerability can ...

PT-2019-10017

Name of the Vulnerable Software and Affected Versions: TWiki version 6.0.2 Description: The issue allows cross-site scripting XSS via the webs parameter in the bin/statistics endpoint. Recommendations: For TWiki version 6.0.2, update to a version that fixes this issue to prevent cross-site...

PT-2019-18386

Name of the Vulnerable Software and Affected Versions AirTies Air5341 version 1.0.0.12 Description The issue allows for a CSRF attack on the cgi-bin/login endpoint. Recommendations For AirTies Air5341 version 1.0.0.12, consider implementing CSRF protection measures, such as token-based validation...

CVE-2019-7385: Improper Neutralization of Special Elements used in an OS Command

An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U2.0.0140521R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a syst...

CVE-2019-6967: Cross-Site Request Forgery (CSRF)

AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF...

CVE-2018-14575: Improper Neutralization of Input During Web Page Generation

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...

CVE-2019-7417: Improper Neutralization of Input During Web Page Generation

XSS exists in Ericsson Active Library Explorer ALEX 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter...

WS-2019-0536

In radare2 in version 2.1.0 to 3.4.1 is vulnerable to Heap-buffer-overflow in rutf8strlen related to libr/bin/p/bindex.c...

Stack overflow

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices possibly WF2411 through WF2880, there is a stack-based buffer overflow that does not require authentication. This can cause denial of service device restart or remote code execution. This vulnerability can be triggered by a GE...

PT-2019-19288

Name of the Vulnerable Software and Affected Versions Netis WF2411 version 2.1.36123 Netis WF2xxx devices versions WF2411 through WF2880 Description The issue is a stack-based buffer overflow that does not require authentication, potentially causing denial of service or remote code execution. Thi...

SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:0423-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation bsc1123156. CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp bsc1119493. CVE-2018-19489:...

grunt-dwebp (>=1.0.0, <=1.1.2), gulp-dwebp (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-10633 via dwebp-bin (1.0.0)

dwebp-bin NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dwebp-bin and may be impacted: - grunt-dwebp =1.0.0, =1.0.0, =1.0.2 Source cves: CVE-2016-10633 Source advisory: GHSA-4PF7-579W-F4GM...

grunt-dwebp (>=1.0.0, <=1.1.2), gulp-dwebp (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-10633 via dwebp-bin (1.0.0)

dwebp-bin NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dwebp-bin and may be impacted: - grunt-dwebp =1.0.0, =1.0.0, =1.0.2 Source cves: CVE-2016-10633 Source advisory: OSV:GHSA-4PF7-579W-F4GM...