CVE-2019-9629

Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults fixed credentials...

CVE-2019-13379

On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in...

June 20, 2019—KB4503277 (Preview of Monthly Rollup)

None None...

RHEL 8 : pki-deps:10.6 (RHSA-2019:1529)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1529 advisory. The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by Red Hat...

SUSE SLED12 / SLES12 Security Update : sssd (SUSE-SU-2019:1480-1)

This update for sssd fixes the following issues : Security issue fixed : CVE-2018-16838: Fixed an authentication bypass related to the Group Policy Objects implementation bsc1124194 Non-security issues fixed: Missing GPOs directory could have led to login problems bsc1132879 Fix a crash by adding...

PT-2019-18160 · Ge · Ge Communicator

Name of the Vulnerable Software and Affected Versions: GE Communicator versions prior to 4.0.517 Description: The issue concerns the presence of two backdoor accounts with hardcoded credentials in the software, potentially allowing control over the database. However, if the default Windows firewa...

Insecure Defaults

mcollective is vulnerable to insecure defaults. The vulnerability exists through a default password set at install...

PT-2019-11709 · Jenkins · Jenkins Static Analysis Utilities Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Static Analysis Utilities Plugin version 1.95 and earlier Jenkins analysis-core Plugin affected versions not specified Description: A cross-site request forgery issue exists due to the lack of permission checks and the acceptance of...

CSRF vulnerability and missing permission check allowed changing default graph configuration in analysis-core

analysis-core has the capability to allow other plugins to display trend graphs for their static analysis results. analysis-core provides the configuration form for the default settings of each graph. The configuration form and form submission handler did not perform a permission check, allowing...

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

openSUSE Security Update : java-11-openjdk (openSUSE-2019-161)

This update for java-11-openjdk to version 11.0.2+7 fixes the following issues : Security issues fixed : - CVE-2019-2422: Better FileChannel transfer performance bsc1122293 - CVE-2019-2426: Improve web server connections - CVE-2018-11212: Improve JPEG processing bsc1122299 - Better route routing ...

Security update for java-11-openjdk (important)

openSUSE Security Update: Security update for java-11-openjdk Announcement ID: openSUSE-SU-2019:0161-1 Rating: important References: 1120431 1122293 1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 CVE-2019-2426 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilitie...

GHSA-PJXW-22XF-6PWC Prototype Pollution in defaults-deep

All versions of defaults-deep are vulnerable to prototype pollution. Provided certain input defaults-deep can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation As no patch is currently available for this vulnerability it is our...

3gtel-frontend-platform (=1.0.0), @achieve-all/v-element (=1.0.0) +406 more potentially affected by CVE-2018-16486 via defaults-deep (>=0.2.3 <=0.2.4)

defaults-deep NPM version =0.2.3, =0.1.1, =1.0.0, =1.0.0, =2.0.0, =2.0.7, =0.1.0, =1.0.0, =1.0.8, =0.1.2, =1.0.3, =1.0.0, =6.0.0-rc1, =7.4.3 and more Source cves: CVE-2018-16486 Source advisory: OSV:GHSA-PJXW-22XF-6PWC...

Prototype Pollution in defaults-deep

All versions of defaults-deep are vulnerable to prototype pollution. Provided certain input defaults-deep can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation As no patch is currently available for this vulnerability it is our...

CVE-2018-16486

A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...

Buffer overflow

A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...

CVE-2018-16486

Summary: CVE-2018-16486 corresponds to a prototype pollution vulnerability in the npm package defaults-deep, affecting versions ≤ 0.2.4. The vulnerability allows an attacker to inject or modify properties on Object.prototype, which can affect all objects in the runtime. Several sources (OSV, GHSA...

CVE-2018-16486

A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...

Insecure Defaults

Apache Tomcat is vulnerable to insecure defaults. The CORS filter provided by default is insecure as it enables supportsCredentials for all origins. This can allow a malicious user unauthorized access to sensitive resources...