7696 matches found
The vulnerability of the OpenNMS monitoring system, a network management platform from Juniper Networks Junos Space, arises due to insufficient protection of the website structure. This allows attackers to disclose protected information or perform actions on behalf of the administrator.
The vulnerability of OpenNMS, which is included in the Juniper Networks Junos Space network management platform, stems from insufficient protection of the website structure. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or carry out actions on behalf ...
Foxit Reader U3D Parsing Out-of-Bounds Read Vulnerability (CNVD-2018-25209)
Foxit Reader is China's Foxit Foxit Software Corporation of a PDF document reader. u3d plugin is one of the general 3D graphics format standard plug-in. Foxit Reader 9.3.0.10826 version of the FoxitReader.exe file of the u3d plugin version 9.3.0.10809 security vulnerabilities. A remote attacker c...
Huawei eSpace Product Using Short Secret Key Vulnerability
Huawei eSpace 7950 is a 7950 series IP phone product from Huawei, China. The Huawei eSpace product suffers from a security vulnerability using a short secret key. When a user makes a call using SRTP, an attacker can launch a man-in-the-middle attack to intercept and decrypt the call information...
Huawei eSpace Product SRTP Logo Display Vulnerability
Huawei eSpace 7950 is a 7950 series IP phone product from Huawei, China. A security vulnerability exists in Huawei eSpace products with SRTP logo display. An attacker can launch a man-in-the-middle attack to intercept messages in a non-secure transmission mode. An attacker who successfully...
CVE-2018-9540
In avrcctrlparsvendorrsp of avrcparsct.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android...
CVE-2018-18591
A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data...
CVE-2018-9361
In processl2capcmd of l2cmain.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0...
IBM Rational Engineering Lifecycle Manager XML External Entity Injection Vulnerability (CNVD-2018-24366)
IBM Rational Engineering Lifecycle Manager is a suite of engineering lifecycle management software from IBM in the United States. A security vulnerability exists in IBM Rational Engineering Lifecycle Manager. An attacker could exploit the vulnerability to disclose sensitive information or consume...
PT-2019-1442 · Openssh +6 · Openssh +6
Name of the Vulnerable Software and Affected Versions: OpenSSH version 7.9 Description: The issue is related to insufficient access control in the OpenSSH utility, specifically in the refresh progress meter function. This can allow a remote attacker to disclose protected information or execute...
Cisco WebEx Meetings Server XML External Entity Injection Vulnerability
Cisco WebEx Meetings Server is a versatile videoconferencing solution from Cisco USA. Cisco WebEx Meetings Server suffers from an XML external entity injection vulnerability, which could allow a remote, unauthenticated attacker to cause confidential data disclosure, denial of service, server-side...
Cisco WebEx Meetings Server XML Injection
I. VULNERABILITY ------------------------- Cisco WebEx Meetings Server XML External Entity II. CVE REFERENCE ------------------------- CVE-2018-18895 III. VENDOR ------------------------- http://cisco.com IV. TIMELINE ------------------------ 18/09/2018 Vulnerability discovered 19/09/2018 Vendor...
lighttpd < 1.4.35 Multiple Vulnerabilities
According to its banner, the version of lighttpd running on the remote host is prior to 1.4.35. It is, therefore, affected by the following vulnerabilities : - A SQL injection flaw exists in the 'modmysqlvhost' module where user input passed using the hostname is not properly sanitized. A remote...
The vulnerability of the xmlStringLenDecodeEntities function (parser.c) in the libxml2 library allows a attacker to cause a service failure or disclose protected information.
The vulnerability of the xmlStringLenDecodeEntities function in the parser.c file of the libxml2 library is due to insufficient restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures or disclose protected informati...
UBUNTU-CVE-2018-18764
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parsemqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...
BSA-2018-733
Security Advisory ID : BSA-2018-733 Component : Fabric OS Proxy Service Revision : 1.0: Initial A vulnerability in the proxy service of Brocade Fabric OS versions could allow remote unauthenticated attackersto obtain sensitive information and possibly cause a denial of service. Affected Products...
Apache Pony Mail Information Disclosure Vulnerability
Apache Pony Mail is a plug-in with mail archiving, viewing and interaction capabilities from the Apache USA Software Foundation. A security vulnerability exists in the statistics generator in Apache Pony Mail versions 0.7 through 0.9, which stems from the statistics generator returning timestamp...
Private Data Disclosure in express-restify-mongoose
Affected versions of express-restify-mongoose are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private. Proof of Concept If you have a user model that you want to protect, such as the following User...
The vulnerability of the JavaScript script handler ChakraCore in browsers Internet Explorer and Microsoft Edge allows a hacker to disclose protected information.
The vulnerability of the JavaScript script handler ChakraCore in browsers Internet Explorer and Microsoft Edge is related to errors in processing objects in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information through a specially crafted web page...