PT-2019-14648

Name of the Vulnerable Software and Affected Versions LogMeIn LastPass versions prior to 4.33.0 Description The issue allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site. This is possible because the do popupregist...

Atlassian Jira Cross-Site Request Forgery Vulnerability (CNVD-2019-30070)

Jira is a tool developed by Australian company Atlassian for defect tracking, issue tracking and project management. A cross-site request forgery vulnerability exists in the doGarbageCollection method of the ViewSystemInfo class in Jira. A remote attacker could exploit this vulnerability to trigg...

AZL-35102 CVE-2018-20969 affecting package patch for versions less than 2.7.6-9

doedscript in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter...

DEBIAN-CVE-2018-20969

doedscript in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter...

bangkok.immigration.go.th Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-928873 Security Researcher KhanJanny Helped patch 3055 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting bangkok.immigration.go.th...

ALPINE-CVE-2019-14274

MCPP 2.7.2 has a heap-based buffer overflow in the domsg function in support.c...

PT-2019-13577 · Mcpp +1 · Mcpp +1

Name of the Vulnerable Software and Affected Versions: MCPP version 2.7.2 Description: The issue is a heap-based buffer overflow in the do msg function located in support.c. This overflow can potentially lead to arbitrary code execution, allowing an attacker to execute malicious code on the...

PT-2019-3242

Name of the Vulnerable Software and Affected Versions GNU patch versions prior to 2.7.7 Description The issue is related to the do ed script function in the GNU Patch utility, which fails to neutralize special elements used in operating system commands. This can be exploited by opening a crafted...

PT-2019-12882 · Zoho · Zoho Manageengine Assetexplorer

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AssetExplorer affected versions not specified Description: An issue was discovered in Zoho ManageEngine AssetExplorer, where there is a cross-site scripting XSS issue via the rdsName parameter in the "RCSettings.do" API...

CVE-2019-12905: Improper Neutralization of Input During Web Page Generation

FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. This issue has been fixed in FileRun 2019.06.01...

PT-2019-13014

Name of the Vulnerable Software and Affected Versions FileRun versions prior to 2019.06.01 Description The issue allows for XSS via the filename to the "/?module=fileman&section=do&page=up" API endpoint. This has been fixed in a later version. Recommendations For versions prior to 2019.06.01,...

PT-2019-8827

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions affected versions not specified Description The issue is related to a possible out of bounds write due to improper input validation while processing the DO ACS vendor command in various Snapdragon products...

PT-2019-2820

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.1.13 Description A NULL pointer dereference issue in the nfc genl deactivate target function can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service...

GHSA-GC94-6W89-HPQR Command Injection in fs-path

All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available...

GHSA-7JFH-2XC9-CCV7 Cross-Site Scripting in public

All versions of public are vulnerable to stored cross-site scripting XSS. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time...

ZOHO ManageEngine ServiceDesk Plus Permission License and Access Control Issues Vulnerability

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A vulnerability exis...

PT-2019-12718

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows SQL Injection via the cvalue parameter in the "index.php?do=sadmin ceditpost" endpoint. Recommendations For UCMS version 1.4.7, avoid using the cvalue parameter in the "index.php?do=sadmin...

CVE-2019-12251: Improper Neutralization of Special Elements used in an SQL Command

sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadminceditpost cvalue parameter...

Emerson DeltaV SE4306T01 IS DO 45 mA CHARM Communications Adapter Detection

Binary data 756663.prm...

PT-2019-12361

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.12 Description The issue exists due to the possibility of XSS via several API endpoints, including "/upload/file.php", "/upload/scp/users.php?do=import-users", and "/upload/scp/ajax.php/users/import", when an agent...