CVE-2019-14243

headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service webserver panic and daemon crash via a crafted HAProxy PROXY v2 request with truncated source/destinatio...

Eclipse Foundation Mosquitto Pattern Based ACL Bypass (CVE-2017-7650)

An ACL bypass vulnerability has been reported in Eclipse Foundation Mosquitto. A remote user can exploit this vulnerability by sending a crafted request to the target server...

The vulnerability relates to the set of tools for developing software for collaborative work within Azure DevOps Server and the Project Management and Version Control system Team Foundation Server. It stems from the lack of measures for cleaning input data, allowing a malicious actor to execute arbitrary code in the context of the current user.

The vulnerability of the Azure DevOps Server and Team Foundation Server project management and version control systems relates to the lack of measures for input data cleansing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, by...

The vulnerability of the Microsoft SharePoint software package arises from insufficient cleaning of data provided by users, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the Microsoft SharePoint software package is related to insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute cross-site scripting attacks with elevated privileges using a specially created...

Arbitrary command execution in slanger

A remote attacker can execute arbitrary commands by sending a crafted request to the server. This is due to the use of Oj.load instead of Oj.strictload when processing messages. Note that slanger is no longer maintained...

Design/Logic Flaw

Slanger 0.6.0 is affected by: Remote Code Execution RCE. The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after...

The vulnerability of the Cockpit server manager, caused by an operation going beyond buffer boundaries in memory, allows a attacker to trigger a service failure.

The vulnerability of the Cockpit server administrator arises from an operation that occurs outside the buffer boundaries of memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause a service failure by sending a specially crafted request along with a specially...

The vulnerability in the platform for creating a unified database and electronic registration of residential properties, “BAR.- ”, is related to insufficient protection of the website structure, allowing a perpetrator to execute arbitrary JavaScript code.

The vulnerability in the platform for creating a unified database and electronic registration of residential properties, “BAR.- ”, is related to insufficient protection of the website’s structure. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary JavaScrip...

The vulnerability of the McAfee Agent for Linux client component, related to errors in processing temporary files, allows a hacker to increase their privileges.

The vulnerability of the McAfee Agent for Linux client component is related to errors in processing temporary files. Exploiting this vulnerability can allow an attacker to enhance their privileges by using a specially created request...

Magento Input Validation Error Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . Magento 2.1.18 before version 2.1, 2.2.9 before version 2.2 and 2.3.2 before version 2.3 there is a security...

The vulnerability of the Netlogon service in the Windows operating system allows a hacker to circumvent existing security restrictions.

The vulnerability of the Netlogon service in the Windows operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially crafted request...

MantisBT < 2.13.2 Information Disclosure Vulnerability - Windows

MantisBT is prone to an information disclosure vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

MantisBT < 2.13.2 Information Disclosure Vulnerability - Linux

MantisBT is prone to an information disclosure vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

WordPress Plugin WPGraphQL Information Disclosure (CVE-2019-9879; CVE-2019-9880; CVE-2019-9881)

An information disclosure vulnerability exists in WordPress Plugin WPGraphQL. A remote attacker could trigger this flaw by sending a crafted request. Successful exploitation may result in the disclosure of sensitive information...

CVE-2019-1628

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service DoS condition on an affected device. The vulnerability is due to incorrect bounds checking. An attacker could...

Cisco Enterprise Chat and Email Attachment Download Vulnerability

A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could explo...

The vulnerability in the web interface for managing software for Cisco Webex Meetings Server allows a perpetrator to disclose protected information.

The vulnerability of the Cisco Webex Meetings Server’s web interface management software is related to configuration errors. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially created request...

IBM API Connect Information Disclosure Vulnerability (CNVD-2019-44943)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. An information disclosure vulnerability exists in IBM API Connect. An attacker can exploit the...

The vulnerability of Microsoft SharePoint Server and Microsoft SharePoint Enterprise Server lies in their lack of access control mechanisms. This allows attackers to carry out cross-site scripting attacks and increase their privileges.

The vulnerability of Microsoft SharePoint Server and Microsoft SharePoint Enterprise Server lies in the lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks and increase their privileges by using a specially crafted...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...