Information Disclosure

rhscon-ceph is vulnerable to information disclosure attacks. The vulnerability exists as rhscon-ceph in Red Hat Storage Console 2 x8664 and Red Hat Storage Console Node 2 x8664 allows local users to obtain the password as cleartext...

Deserialization Of Untrusted Data

Apache ActiveMQ allows for deserialization of objects both in the Broker and in any applications which process ObjectMessage messages, specifically by using ObjectMessagegetObject. Broker deserialization happens in HTTP, Stop, Web Console, and other components. The deserialization in versions 5.0...

Denial Of Service (DoS)

qemu-kvm-rhev is vulnerable to denial of service. It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and the payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of servi...

Clickjacking

jboss is vulnerable to clickjacking attacks. It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console Clickjacking...

Information Leakage

Cumin aka MRG Management Console is vulnerable to information leakage. The vulnerability exists because of the use of weak DES-based hash function to hash password, allowing the attacker to brute-force to get plain text...

Cross-site Scripting

console-common is vulnerable to cross-site scripting XSS attacks. They are possible because it does not perform HTML escaping properly...

Cross-site Request Forgery

OpenShift is susceptible to Cross-Site Request Forgery CSRF attacks. It has a flaw in management console openshift console/app/controllers/applicationcontroller.rb, allowing the attacker to steal the authenticated user session...

GHSA-CQ9C-55R7-455X Improper Authentication in Apache Karaf

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web...

CVE-2018-19505

Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution involving a...

PVS target devices are randomly getting unregistered and going down in PVS console

Target devices show up and running in hypervisor console Targets show down in PVS console and get unregistered intermittently Restart fixes the issue During the time of issue, ping to the target device works,but RDP fails...

SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2018:4086-1)

This update for qemu fixes the following issues : Security issue fixed : CVE-2018-16847: Fixed an out of bounds r/w buffer access in cmb operations bsc1114529. Non-security issue fixed: Fixed serial console issue in SLES 12 SP2 that triggered a qemu-kvm bug bsc1108474. Note that Tenable Network...

WEM Admin console fails to connect with error "Error while connecting to the specified Infrastructure Server!"

WEM admin console fails to connect with error "Error while connecting to the specified Infrastructure Server!" The Citrix WEM Console Trace.Log file located in the user profile %username% reports the following error: "Exception - ConnectToBroker.Run : System.Net.Sockets.SocketException : No...

Cross site scripting

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

BlackBerry Unified Endpoint Manager Cross-Site Scripting Vulnerability

BlackBerry Unified Endpoint Manager UEM is a unified endpoint management solution from BlackBerry Canada. The solution is used to manage endpoint devices and view their access. A security vulnerability exists in BlackBerry UEM. An attacker could exploit this vulnerability to be able to store scri...

BlackBerry Unified Endpoint Manager Cross-Site Scripting Vulnerability (CNVD-2019-39169)

BlackBerry Unified Endpoint Manager UEM is a unified endpoint management solution from BlackBerry Canada. The solution is used to manage endpoint devices and view their access. A security vulnerability exists in BlackBerry UEM. No information is currently available about this vulnerability, which...

Veeam Availability Console U1 Cumulative Patch 1913

Challenge Veeam Availability Console U1 Cumulative Patch 1913. This update supersedes Veeam Availability Console U1 Cumulative Patch 1850. Cause Please confirm you are running version 2.0.2.1750 or later prior to installing this cumulative patch 1913. You can check this under Windows Programs and...

BlackBerry Unified Endpoint Manager Cross-Site Scripting Vulnerability (CNVD-2019-39170)

BlackBerry Unified Endpoint Manager UEM is a unified endpoint management solution from BlackBerry Canada. The solution is used to manage endpoint devices and view their access.A security vulnerability exists in BlackBerry UEM. An attacker could exploit this vulnerability to make changes to UEM...

Design/Logic Flaw

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with...

CVE-2018-17246

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with...

CVE-2018-17246

CVE-2018-17246 affects Kibana prior to 6.4.3 and 5.6.13, due to an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a crafted request that attempts to execute JavaScript, potentially leading to arbitrary commands executed with the K...