CVE-2019-13183

CVE-2019-13183 : Flarum before 0.1.0-beta.9 is vulnerable to cross-site request forgery (CSRF) on all POST endpoints, demonstrated by changing admin settings. The issue affects Flarum open-source forum software prior to the 0.1.0-beta.9 release; no explicit root-cause details beyond CSRF exposure...

CVE-2019-1932

A vulnerability in Cisco Advanced Malware Protection AMP for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit thi...

Input validation

A vulnerability in Cisco Advanced Malware Protection AMP for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit thi...

CVE-2019-1932 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability

A vulnerability in Cisco Advanced Malware Protection AMP for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit thi...

CVE-2019-1932

The CVE-2019-1932 issue affects Cisco AMP for Endpoints (Windows). The vulnerability arises from insufficient validation of dynamically loaded modules, enabling a local authenticated attacker with administrator privileges to place a file in a specific Windows path and execute code with the AMP se...

Cisco Advanced Malware Protection for Endpoints for Windows Command Injection Vulnerability

Cisco Advanced Malware Protection AMP for Endpoints for Windows is a Windows-based endpoint security solution from Cisco. The product mainly has advanced threat prevention, monitoring and response features. A command injection vulnerability exists in Cisco?AMP for Endpoints 6.2.3.10807030519 and...

CVE-2019-6637

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

CVE-2019-6637

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

Code injection

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

CVE-2019-6637

CVE-2019-6637 affects BIG-IP ASM: exploitation of REST endpoints by an authenticated user (role: Guest or higher) can trigger excessive memory consumption, causing the Linux kernel OOM killer and potential DoS. Affected: BIG-IP ASM versions 12.1.0–12.1.4, 13.0.0–13.1.1.4, 14.0.0–14.0.0.4, 14.1.0–...

CVE-2019-5630

A Cross-Site Request Forgery CSRF vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request...

CVE-2019-5630

A Cross-Site Request Forgery CSRF vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request...

CVE-2019-5630 Rapid7 Nexpose/InsightVM Security Console CSRF

A Cross-Site Request Forgery CSRF vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request...

CVE-2019-5630

CVE-2019-5630 affects Rapid7 Nexpose InsightVM Security Console. The vulnerability is a Cross-Site Request Forgery (CSRF) in API endpoints that can be exploited via Flash to bypass a cross-domain pre-flight OPTIONS request. Affected versions are 6.5.0 through 6.5.68. The issue arises from insuffi...

CVE-2018-20812

An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel when Traffic Enforcement was enabled exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack IPv4/IPv6 endpoints...

CVE-2018-20812

An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel when Traffic Enforcement was enabled exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack IPv4/IPv6 endpoints...

Information disclosure

An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel when Traffic Enforcement was enabled exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack IPv4/IPv6 endpoints...

ZEIT: Access control bypass leads to domain information disclosure

Summary: By leveraging the domain verification endpoint I can obtain sensitive information about the user who registered the domain within the zeit UI including username, email address, userId, and customerId. In addition, some high level information about the domain is included as well such as...

PT-2019-3866 · Fasterxml +3 · Jackson-Databind +3

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x through 2.9.9 Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has JDOM 1.x or...