CVE-2018-19555

tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password...

CVE-2018-19555: Cross-Site Request Forgery (CSRF)

tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password...

PT-2018-15000

Name of the Vulnerable Software and Affected Versions TELEPORT version 3.1.0 Description The issue allows for a CSRF attack via the "user/do-reset-password" endpoint to change any password, including the administrator password. Recommendations For version 3.1.0, as a temporary workaround, conside...

FCC Addresses Robocalling – But Questions Remain

Robocalls and text spam – often in the service of widespread fraud campaigns – continue to persist, dogging consumers despite the existence of the national Do Not Call registry and efforts like the Truth in Caller ID Act. In an effort to alleviate the situation, Federal Communications Commission...

PT-2018-3378

Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 3.1 Description: The issue is related to the pnv lpc do eccb function in the QEMU emulator, specifically in the hw/ppc/pnv lpc.c file. It involves a buffer data boundary read issue. Exploitation of this issue could allo...

CVE-2018-19061

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

389-ds-base: Mishandled search requests in servers/slapd/search.c:do_search() allows for denial of service

It was found that a specially crafted search query could lead to excessive CPU consumption in the dosearch function. An unauthenticated attacker could use this flaw to provoke a denial of service...

PT-2018-3380

Name of the Vulnerable Software and Affected Versions: QEMU version 3.0.0 Description: The issue is related to the lsi do msgin function in the QEMU hardware emulator, specifically in the hw/scsi/lsi53c895a.c file. It involves a buffer data boundary read issue. Exploitation of this issue could...

CVE-2018-18702

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=importrule because the upfile content is base64 decoded, deserialized, and used for database insertion...

PT-2018-14580

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.11 Description The issue concerns SQL injection in the spider.admincp.php file of iCMS. This occurs because the content of upfile is base64 decoded, deserialized, and then used for database insertion, specifically through the...

DEBIAN-CVE-2018-18559

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain...

vitoriadomearim.ma.gov.br XSS vulnerability

Open Bug Bounty ID: OBB-684746 Description| Value ---|--- Affected Website:| vitoriadomearim.ma.gov.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

Red Hat 389 Directory Server Denial of Service Vulnerability (CNVD-2019-02473)

Red Hat 389 Directory Server formerly known as Fedora Directory Server is an enterprise-class Linux directory server from Red Hat. The server fully supports the LDAPv3 specification and features scalability, multi-master replication, and more. A security vulnerability exists in the 'dosearch'...

CVE-2018-0480

A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause the device to crash, leading to a denial of service DoS condition. The vulnerability is due to a race condition that occurs when the VLAN and port enter an...

PT-2018-12639

Name of the Vulnerable Software and Affected Versions 389 Directory Server affected versions not specified Description A flaw was found in the 389 Directory Server, where a specially crafted search query could lead to excessive CPU consumption in the do search function. This could allow an...

HDF5 Denial of Service Vulnerability

HDF5 is a free suite of tools for managing the storage of different types of data that can be managed, manipulated, viewed, analyzed, and generated in portable formats. A denial of service vulnerability exists in the 'ReadCode' function of the decompress.c file in HDF5 1.10.3 and earlier versions...

PT-2018-12635

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.19-rc1 through 4.19-rc3 Description A security flaw was found in the ip frag reasm function, which can cause a later system crash in ip do fragment. With certain non-default configuration of a victim host, an attacker c...

PT-2018-13899

Name of the Vulnerable Software and Affected Versions Tinyftpd version 1.1 Description A buffer overflow issue exists in the text variable of the do mkd function in the ftpproto.c file. This allows an attacker to potentially overwrite ebp by providing a long pathname. Recommendations For Tinyftpd...

Mgetty Command Injection Vulnerability (CNVD-2019-03439)

Mgetty is a getty replacement program for data and fax operations. A command injection vulnerability exists in Mgetty versions prior to 1.2.1, which stems from the 'doactivate' function failing to properly filter shell metacharacters in the fax/faxq-helper.c file, which can be exploited by an...

do-blog.jp XSS vulnerability

Open Bug Bounty ID: OBB-674040 Description| Value ---|--- Affected Website:| do-blog.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...