CVE-2018-20212

CVE-2018-20212 affects TWiki 6.0.2, specifically the bin/statistics component, where the webs parameter enables cross-site scripting (XSS). The vulnerability is described as a parameter-based XSS in TWiki/bin/statistics, with CVSS vectors indicating network attack, low to moderate complexity, and...

PT-2019-18386

Name of the Vulnerable Software and Affected Versions AirTies Air5341 version 1.0.0.12 Description The issue allows for a CSRF attack on the cgi-bin/login endpoint. Recommendations For AirTies Air5341 version 1.0.0.12, consider implementing CSRF protection measures, such as token-based validation...

CVE-2018-20212: Improper Neutralization of Input During Web Page Generation

bin/statistics in TWiki 6.0.2 allows cross-site scripting XSS via the webs parameter...

PT-2019-10017

Name of the Vulnerable Software and Affected Versions: TWiki version 6.0.2 Description: The issue allows cross-site scripting XSS via the webs parameter in the bin/statistics endpoint. Recommendations: For TWiki version 6.0.2, update to a version that fixes this issue to prevent cross-site...

CVE-2019-7385: Improper Neutralization of Special Elements used in an OS Command

An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U2.0.0140521R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a syst...

CVE-2019-7417: Improper Neutralization of Input During Web Page Generation

XSS exists in Ericsson Active Library Explorer ALEX 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter...

PT-2019-18591

Name of the Vulnerable Software and Affected Versions Ericsson Active Library Explorer ALEX version 14.3 Description A security issue exists in the software, where an XSS issue is present in multiple parameters of the "/cgi-bin/alexserv" servlet. The affected parameters include DB, FN, fn, and id...

CVE-2019-6967: Cross-Site Request Forgery (CSRF)

AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF...

PT-2019-9038

Name of the Vulnerable Software and Affected Versions Trash Bin plugin version 1.1.3 for MyBB Description The issue concerns cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. The XSS vulnerability can be triggered via a thread subject, while the CSRF vulnerability can ...

CVE-2018-14575: Improper Neutralization of Input During Web Page Generation

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting XSS via a thread subject and a cross-site request forgery CSRF via a post subject...

WS-2019-0536

In radare2 in version 2.1.0 to 3.4.1 is vulnerable to Heap-buffer-overflow in rutf8strlen related to libr/bin/p/bindex.c...

Stack overflow

On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices possibly WF2411 through WF2880, there is a stack-based buffer overflow that does not require authentication. This can cause denial of service device restart or remote code execution. This vulnerability can be triggered by a GE...

PT-2019-19288

Name of the Vulnerable Software and Affected Versions Netis WF2411 version 2.1.36123 Netis WF2xxx devices versions WF2411 through WF2880 Description The issue is a stack-based buffer overflow that does not require authentication, potentially causing denial of service or remote code execution. Thi...

SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:0423-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation bsc1123156. CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp bsc1119493. CVE-2018-19489:...

dwebp-bin downloads Resources over HTTP

Affected versions of dwebp-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...

GHSA-4PF7-579W-F4GM dwebp-bin downloads Resources over HTTP

Affected versions of dwebp-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...

scalajs-standalone-bin (>=0.1.0, <=0.4.3), tpr (>=0.2.0, <=0.2.2) potentially affected by CVE-2016-10627 via scala-bin (>=0.2.1, <=0.3.3)

scala-bin NPM version =0.2.1, =0.1.0, =0.2.0, =0.2.2 Source cves: CVE-2016-10627 Source advisory: OSV:GHSA-3VV5-42WR-M32G...

Downloads Resources over HTTP in scala-bin

Affected versions of scala-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...

GHSA-3VV5-42WR-M32G Downloads Resources over HTTP in scala-bin

Affected versions of scala-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...

scalajs-standalone-bin Downloads Resources over HTTP

Affected versions of scalajs-standalone-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executio...