CMS Made Simple 2.2.10 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ============================================= MGC ALERT 2019-002 - Original release date: April 10, 2019 - Last revised: May 22, 2019 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score - CVE-ID: CVE-2019-11226...

openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1439) (Spectre)

This update for java-180-openjdk to version 8u212 fixes the following issues : Security issues fixed : - CVE-2019-2602: Better String parsing bsc1132728. - CVE-2019-2684: More dynamic RMI interactions bsc1132732. - CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID bsc1132729. - CVE-2019-2422...

OPENSUSE-SU-2019:1438-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to version 8u212 fixes the following issues: Security issues fixed: - CVE-2019-2602: Better String parsing bsc1132728. - CVE-2019-2684: More dynamic RMI interactions bsc1132732. - CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID bsc1132729. - CVE-2018-3639:...

HackerOne: Password not checked when disabling 2FA on HackerOne

Hi, when I was submitted a report to a program that request 2FA ON, I notice that if you try to disable this option will ask for backup code - password and if you enter a random password in the request filed and a correct backup code it will be successfully disabled the 2FA without check if the...

PT-2019-12717 · Identityserver · Identityserver

Name of the Vulnerable Software and Affected Versions: IdentityServer versions 4 through 2.4 Description: The issue is related to stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method. This can be triggered by viewing a log. It's worth noting...

PT-2019-2927 · Mysql Server +4 · Mysql Connector/J +4

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.9 Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has the...

Exploit for Use After Free in Microsoft

CV...

SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1219-1) (Spectre)

This update for java-180-openjdk to version 8u212 fixes the following issues : Security issues fixed : CVE-2019-2602: Better String parsing bsc1132728. CVE-2019-2684: More dynamic RMI interactions bsc1132732. CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID bsc1132729. CVE-2019-2422: Better...

SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:1211-1) (Spectre)

This update for java-180-openjdk to version 8u212 fixes the following issues : Security issues fixed : CVE-2019-2602: Better String parsing bsc1132728. CVE-2019-2684: More dynamic RMI interactions bsc1132732. CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID bsc1132729. CVE-2018-3639: fix...

PT-2019-10790

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 version 4.9.3 Sierra Wireless AirLink ALEOS affected versions not specified Description A remote code execution issue exists in the upload.cgi functionality of Sierra Wireless AirLink devices. A crafted HTTP reque...

CVE-2019-1859 Cisco Small Business Switches Secure Shell Certificate Authentication Bypass Vulnerability

A vulnerability in the Secure Shell SSH authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. ...

PT-2019-18201 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 12.1.0 through 12.1.4 F5 BIG-IP versions 13.0.0 through 13.1.1.4 F5 BIG-IP versions 14.0.0 through 14.1.0.1 Description: The Traffic Management Microkernel TMM may restart when a virtual server has an HTTP/2 profile with...

Bashter - Web Crawler, Scanner, And Analyzer Framework

Bashter is a tool for scanning a Web-based Application. Bashter is very suitable for doing Bug Bounty or Penentration Testing. It is designed like a framework so you can easily add a script for detect vulnerability. For Example You can add something script like this:...

PT-2019-18320 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 9.4.16811 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

PT-2019-18328 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 9.4.1.16828 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...

PT-2019-18332 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2019.010.20098 Description: This issue allows remote attackers to disclose sensitive information on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious...

PT-2019-18321 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 9.4.0.16811 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...

PT-2019-12248

Name of the Vulnerable Software and Affected Versions Matrix Sydent versions prior to 1.0.2 Description The issue arises from the handling of registration restrictions based on e-mail domain in util/emailutils.py. Specifically, when the allowed local 3pids option is enabled, it can lead to...

Oracle WebLogic Server high-risk security vulnerability alerts-a vulnerability alert-the black bar safety net

2019 04 May 17, 360CERT detection to the Oracle in 4 December 17 release of the security Bulletin. The security Bulletin disclosed the WebLogic Server there are multiple high-risk vulnerabilities that affect multiple WebLogic components. 360CERT it is determined that the security updates for...

PT-2019-10745 · Feingeist · Shimo Vpn

Name of the Vulnerable Software and Affected Versions: Shimo VPN version 4.1.5.1 Description: A privilege escalation issue exists in the helper service, specifically in the configureRoutingWithCommand function. This allows a user with local access to elevate their privileges to root. An attacker...