CVE-2019-10199

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

CVE-2019-10199

CVE-2019-10199 affects Keycloak up to version 6.0.1. The account console did not perform adequate header checks in some requests, enabling an attacker to trigger operations by crafting requests from an untrusted domain and persuading an authenticated user to perform actions. Red Hat advisories li...

CVE-2019-0346

Unencrypted communication error in SAP Business Objects Business Intelligence Platform Central Management Console, version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure...

CVE-2019-0345

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

CVE-2019-0335

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console, versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the...

Server side request forgery (ssrf)

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

CVE-2019-0346

The CVE-2019-0346 entry concerns SAP Business Objects Business Intelligence Platform (Central Management Console) v4.2, where an unencrypted communication error can disclose the list of user names and roles imported from SAP NetWeaver BI systems. The affected component is the Central Management C...

CVE-2019-0345

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

CVE-2019-0335

SAP BusinessObjects BI Platform Central Management Console (versions 4.1–4.3) is affected by a stored XSS in the user description field. An attacker can store a payload in a user’s description that executes when the mouse hovers over the description in the UI’s info popup. The available documents...

keycloak: CSRF check missing in My Resources functionality in the Account Console

It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

Intel® RAID Web Console 2 Advisory

Summary: Intel has identified a potential vulnerability in the Intel® RAID Web Console 2 RWC2. Intel has issued a Product Discontinuation notice for RWC2. Intel recommends that users uninstall Intel® RWC2, then install RAID Web Console 3 RWC3. Vulnerability Details: CVEID: CVE-2019-0173...

HPE 3PAR StoreServ Management Console Authorization Bypass Vulnerability

The HPE 3PAR StoreServ Management Console SSMC is an HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. An authorization bypass vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. An attacker could...

HPE 3PAR StoreServ Management Console Cross-Site Scripting Vulnerability

The HPE 3PAR StoreServ Management Console SSMC is the HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A cross-site scripting vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. An attacker could...

HPE 3PAR StoreServ Management Console Authorization Bypass Vulnerability (CNVD-2019-28115)

The HPE 3PAR StoreServ Management Console SSMC is the HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A remote authorization bypass vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. An attacker...

HPE 3PAR StoreServ Management Console Information Disclosure Vulnerability

The HPE 3PAR StoreServ Management Console SSMC is the HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A remote information disclosure vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. An attacker...

3CX Phone system (web) management console code issue vulnerability

3CX Phone system web management console is a web-based management console program for the 3CX phone system. A code issue vulnerability exists in 3CX Phone system web management console versions 12.5.44178.1002 through 12.5 SP2. The vulnerability arises from an improperly designed or implemented...

HPE 3PAR StoreServ Management Console Session Reuse Vulnerability

The HPE 3PAR StoreServ Management Console SSMC is an HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A remote session reuse vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. Detailed vulnerabilit...

HPE 3PAR StoreServ Management Console Script Injection Vulnerability

The HPE 3PAR StoreServ Management Console SSMC is the HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A script injection vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. An attacker could exploi...

NewStart CGSL CORE 5.04 / MAIN 5.04 : xorg-x11-server Vulnerability (NS-SA-2019-0045)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xorg-x11-server packages installed that are affected by a vulnerability: - An incorrect permission check for -modulepath and -logfile options when starting Xorg X server allows unprivileged users with the ability to log in ...

CVE-2019-13176

An issue was discovered in the 3CX Phone system web management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF reading local files, outbound HTTP, and outbound DNS...