Code injection

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked...

CVE-2019-13419

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked...

CVE-2019-13419

The CVE-2019-13419 issue affects floragunn Search Guard (Search Guard) prior to version 23.1, where aggregations could leak cleartext values of anonymised fields. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD) with a common description: before 23.1, an information di...

CVE-2019-1953

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-1953

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

Default credentials

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-1953 Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-1953

CVE-2019-1953 affects Cisco Enterprise NFV Infrastructure Software (NFVIS) web portal. The issue is due to incorrect logging of the admin password when a user is forced to modify the default password on first login, allowing an authenticated attacker to view the admin cleartext password. Impact i...

Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

July 16, 2019—KB4507437 (Preview of Monthly Rollup)

None None...

Man-in-the-Middle (MitM)

Overview yarn is a package for dependency management. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. Npm credentials such as authToken were found to be sent over clear text when processing scoped packages that are listed as resolved. This could allow a suitably...

Insecure Cookie Configuration

apache guacamole uses an insecure cookie configuration. The secure flag is not configured on session tokens, which would allow an attacker to obtain the session tokens in clear text...

libvirt security update

5.0.0-9.el7 - qemu: remove cpuhostmask and cpuguestmask from virCaps structure Wim ten Have Orabug: 29956508 5.0.0-8.el7 - api: disallow virDomainSaveImageGetXMLDesc on read-only connections Jan Tomko Orabug: 29955742 CVE-2019-10161 - domain: Define explicit flags for saved image xml Eric Blake...

Dropbox desktop application information disclosure vulnerability

Dropbox desktop application is an open source, cross-platform file online storage, synchronization, and sharing application from Dropbox, Inc. A security vulnerability exists in the Dropbox desktop application version 71.4.108.0, which originates from the Dropbox.exe file and the...

Cross site scripting

An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In thi...

CVE-2017-8406

An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In thi...

CVE-2017-8406

CVE-2017-8406 affects D-Link DCS-1130 devices. The issue is that crossdomain.xml is accessible without restrictions, allowing a hosted flash file on any domain to call the device’s webserver and retrieve stored information, including credentials in clear text. The description also notes lack of c...

Debian DSA-4469-1 : libvirt - security update

Two vulnerabilities were discovered in Libvirt, a virtualisation abstraction library, allowing an API client with read-only permissions to execute arbitrary commands via the virConnectGetDomainCapabilities API, or read or execute arbitrary files via the virDomainSaveImageGetXMLDesc API...

CVE-2019-12897

Edraw Max 7.9.3 has a Read Access Violation at the Instruction Pointer after a call from ObjectModule!Paint::Clear+0x0000000000000074...

CVE-2019-12897

CVE-2019-12897 affects Edraw Max 7.9.3. The vulnerability is described as a Read Access Violation at the Instruction Pointer triggered after a call from ObjectModule!Paint::Clear+0x... (address provided). Connected sources corroborate this description across multiple feeds; no additional technica...