CVE-2019-19898

In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely...

Design/Logic Flaw

In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely...

CVE-2019-19898

In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely...

CVE-2019-19898

CVE-2019-19898 affects IXP EasyInstall 6.2.13723. The description states that cleartext credentials are transmitted over network communications on TCP port 20050 when using the Administrator console remotely, exposing confidentiality. The connected documents corroborate the same details. No expli...

CVE-2019-15712

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for...

CVE-2019-5593

Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...

Veeam Availability Console v3 Patch 4 (build 2795)

Challenge Veeam Availability Console v3 Patch 4 build 2795. This update supersedes Veeam Availability Console v3 Patch 3 build 2762. Cause Please confirm you are running version 3.0.0.2647 or later prior to installing this Patch 4. You can check this under Windows Programs and features. After...

CVE-2020-5217

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

CVE-2020-5217 Directive injection when using dynamic overrides with user input in RubyGems secure_headers

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

The vulnerability of the XML_PARSE_HUGE configuration in the console-based ImageMagick graphics editor allows a attacker to trigger a service failure.

The vulnerability of the XMLPARSEHUGE configuration in the console-based ImageMagick graphics editor is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to cause service failures remotely...

The vulnerability of the Advanced Console identity manager component of Oracle Identity Manager allows a perpetrator to compromise data integrity or expose sensitive information.

The vulnerability of the Advanced Console controller component of Oracle Identity Manager is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise data integrity or disclose sensitive information using the HTTP protocol...

The vulnerability of Brodade’s IP and SAN network management system, related to deficiencies in user account storage, allows unauthorized access to protected information by attackers.

The vulnerability of the Brocade Network Advisor system for managing IP networks and Storage Area Networks is related to deficiencies in data storage. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information through access to the JMX console...

VulnCheck KEV: CVE-2019-9489

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan versions XG and 11.0, and Worry-Free Business Security versions 10.0, 9.5 and 9.0 could allow an attacker to modify arbitrary files on the affected product's management console...

LOLBITS - C# Reverse Shell Using Background Intelligent Transfer Service (BITS) As Communication Protocol

LOLBITS is a C reverse shell that uses Microsoft's Background Intelligent Transfer Service BITS to communicate with the Command and Control backend. The Command and Control backend is hidden behind an apparently harmless flask web application and it's only accesible when the HTTP requests receive...

Oracle WebLogic Server Multiple Vulnerabilities (Jan 2020 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Third Party Tools Bouncy Castle Java Library component of Oracle WebLogic Server. An unauthenticated attacker with network access via HTTPS could explo...

CVE-2020-2544

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2020-2547

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromi...

CVE-2020-2519

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2020-2729

CVE-2020-2729 affects Oracle Identity Manager (Identity Manager Advanced Console) in Oracle Fusion Middleware. Affected versions are 11.1.2.3.0 and 12.2.1.3.0. An attacker with network access via HTTP and low privileges can compromise Identity Manager, leading to unauthorized update/insert/delete...