11885 matches found
electricflow globally and unconditionally disabled SSL/TLS certificate validation
electricflow unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM during the deployment/publication of an application. electricflow no longer does that. Instead, the existing opt-in option to ignore SSL/TLS errors is used during deployment for the specific...
Python Information Disclosure Vulnerability (CNVD-2019-17319)
Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. An information disclosure vulnerability exists in Python. The vulnerability stems from errors such as...
CVE-2019-6532
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution...
CVE-2019-6532
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution...
Yubico pam-u2f information disclosure vulnerability
Yubico pam-u2f is a portable authentication module for U2F. An information disclosure vulnerability exists in Yubico pam-u2f version 1.0.7. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An unauthorized attacker could...
The vulnerability of the Storage Service component of the Windows operating system, which allows a hacker to increase their privileges
The vulnerability of the Windows operating system’s Storage Service component is related to privilege management errors. Exploiting this vulnerability can allow a remote attacker to increase their privileges...
The vulnerability of the Access Connectivity Engine component in the Microsoft Office software allows a hacker to execute arbitrary code.
The vulnerability of the Access Connectivity Engine component of the Microsoft Office software suite is related to errors in object processing in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the RESTful service programming interface of the Cisco Identity Services Engine, a connection policy management platform, allows a perpetrator to generate arbitrary certificates signed by internal certification services.
The vulnerability of the RESTful Services Programmable Interface ERS implementation of the Cisco Identity Services Engine platform is related to authentication errors. Exploiting this vulnerability allows a malicious actor to generate arbitrary certificates signed by the internal certification...
The vulnerability of the Access Connectivity Engine component in the Microsoft Office software allows a hacker to execute arbitrary code.
The vulnerability of the Access Connectivity Engine component of the Microsoft Office software suite is related to errors in object processing in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser allows a hacker to execute arbitrary code.
The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is related to errors in memory object handling. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
Fuzzing: Common Tools and Techniques
Fuzzing is a software testing methodology that can be used from either a black or white box perspective and predominantly consists of providing deliberately malformed inputs to an application to identify errors such as unhandled exceptions, memory spikes, thread hangs, read access violations or...
PHOENIX CONTACT PLCNext AXC F 2152
1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Phoenix Contact Equipment: PLCNext AXC F 2152 Vulnerabilities: Key Management Errors, Improper Access Control, Man-in-the-Middle, Using Component with Known Vulnerabilities 2. RISK EVALUATION...
The vulnerability of the Cisco Application Policy Infrastructure Controller automation tool, related to errors in the encryption key deletion mechanism, allows a perpetrator to gain access to protected information.
The vulnerability of the Cisco Application Policy Infrastructure Controller automation tool is related to errors in the mechanism for deleting encryption keys. Exploiting this vulnerability could allow an attacker to gain access to protected information...
The vulnerability of the mechanism for managing the identification of web interfaces of microprogramming software-based wireless access controller devices from Cisco Wireless LAN Controllers allows attackers to compromise the integrity of protected information.
The vulnerability of the mechanism for identifying web interfaces of microprogrammed software controllers for Cisco Wireless LAN Controllers WLC is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information by...
The vulnerability of the Simple Network Management Protocol implementation in microprogrammed network devices from Cisco Catalyst allows a intruder to cause service interruptions.
The vulnerability of the Simple Network Management Protocol SNMP implementation in Cisco Catalyst network devices is related to resource management errors. Exploiting this vulnerability allows a malicious actor to trigger maintenance failures through a specially crafted request...
The vulnerability of the Analysis Services service of the Microsoft SQL Server database management system allows a perpetrator to gain access to protected information.
The vulnerability of the Analysis Services service in the Microsoft SQL Server database management system is related to errors in processing SQL queries. Exploiting this vulnerability may allow an attacker, operating remotely, to gain access to protected information...
The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser, related to errors in memory object handling, allows a hacker to execute arbitrary code.
The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is related to errors in processing objects in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...
The vulnerability of the SSH network protocol implementation in Cisco Wireless LAN Controllers allows a intruder to gain unauthorized access to protected information.
The vulnerability of the Secure Shell SSH network protocol implementation in Cisco Wireless LAN Controller WLC software relates to access control errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and network device management system, as well as the Cisco Evolved Programmable Network Manager software, allows a malicious actor to execute arbitrary SQL queries.
The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network Manager software relates to input validation errors. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries by sending specially...
The vulnerability of the synchronization identifier application in the Cisco Directory Connector lies in errors in the path validation mechanism, allowing an intruder to gain unauthorized access to protected information.
The vulnerability of the application for synchronizing identifiers in the Cisco Directory Connector is related to errors in the mechanism for checking the path of dynamically attached libraries. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...