PRODSECBUG-2202: Security bypass via form data injection

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

Netdata JSON Injection Vulnerability

Netdata is a real-time Linux performance monitoring tool. Netdata 1.10.0 suffers from a JSON injection vulnerability. An attacker can exploit this vulnerability to conduct JSON injection attacks via the api/v1/data tqx parameter...

AUO Solar Data Recorder 1.3.0 - addr Cross-Site Scripting

AUO Solar Data Recorder 1.3.0 - addr Cross-Site Scripting Exploit Title: AUO Solar Data Recorder - Stored XSS Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO Solar Data Recorder all versions prior to v1.3.0 Tested on: It is a proprietary devices...

PT-2019-12616

Name of the Vulnerable Software and Affected Versions HPE Integrated Lights-Out 4 iLO 4 versions prior to 2.61b HPE Integrated Lights-Out 5 iLO 5 versions prior to 1.39 Description A remote buffer overflow issue was identified. Vulnerabilities could be exploited remotely to allow Cross-Site...

PT-2019-12615

Name of the Vulnerable Software and Affected Versions HPE Integrated Lights-Out 4 iLO 4 versions prior to 2.61b HPE Integrated Lights-Out 5 iLO 5 versions prior to 1.39 Description A remote cross-site scripting issue was found, which could be exploited to allow Cross-Site Scripting XSS,...

HPESBHF03917 rev.3 - HPE Integrated Lights-Out 4 (iLO 4), and HPE Integrated Lights-Out 5 (iLO 5), Multiple Remote Vulnerabilities

Potential Security Impact: Remote: Cross-Site Scripting XSS, Unauthorized Data Injection, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers -Prior to 1.40a HPE Integrated Lights-Out 4 iLO 4 -Prior to 2.70...

Edge no prior knowledge of the exploit--Advanced-Edition-vulnerability warning-the black bar safety net

Previously The previous article we talked about the need to fake a TypedArray to achieve arbitrary address read and write. Want to fake any object, you first need to know the object's metadata, the need to fake the TypedArray metadata how to get it? To add some background knowledge The following ...

CVE-2019-6538

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro IC...

CVE-2019-6538: Improper Access Control

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro IC...

PT-2019-18150

Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Monitor versions 24950 through 24952 CareLink Monitor version 2490C CareLink 2090 Programmer Amplia CRT-D Claria CRT-D Compia CRT-D Concerto CRT-D Concerto II CRT-D Consulta CRT-D Evera ICD Maximo II CRT-D and ICD Mirro IC...

Design/Logic Flaw

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

CVE-2019-7580

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

CVE-2019-7580

ThinkCMF 5.0.190111 is vulnerable to remote code execution (RCE) due to a lack of proper input validation. An attacker can execute arbitrary PHP code and OS commands by exploiting the mishandling of a single quote character within the portal/admin_category/addpost.html alias parameter . This flaw...

HPESBUX03909 rev.1 - HP-UX Web Server Suite running Apache on HP-UX 11iv3, Multiple Remote Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Unauthorized Data Injection, Unauthorized Read Access to Data SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX Apache-based Web Server B.11.31 - httpd prior to B.2.4.18.04 CVSS Scores: | CVE | CVSS Vector | Base Score ...

Input validation

aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza...

PYSEC-2019-1

aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza...

PT-2019-11261

Name of the Vulnerable Software and Affected Versions: aioxmpp versions 0.10.2 and earlier Description: The issue is related to improper handling of structural elements in the Stanza Parser, specifically during error processing in the aioxmpp.xso.model.guard function. This can result in Denial of...

PT-2019-20158

Name of the Vulnerable Software and Affected Versions aioxmpp versions 0.10.2 and earlier Description The issue is related to improper handling of structural elements in the Stanza Parser, specifically during error processing in the aioxmpp.xso.model.guard function. This can result in a Denial of...

CVE-2019-6713

app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a fileputcontents call...