998 matches found
CVE-2019-16869
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...
Yikes! iOS 13 Coming Next Week With iPhone LockScreen Bypass Bug
Good news... next week, on September 19, Apple will roll out iOS 13, the latest version of its mobile operating system. Yes, we're excited about, but here comes the bad news... iOS 13 contains a vulnerability that could allow anyone to bypass the lockscreen protection on your iPhone and access so...
The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a attacker to gain access to confidential data.
The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file parsing involves the ability to read any local files on the server when default typing is enabled. A special jar-connector-mysql-connector-java is also available and points to classes at the final JSON...
br.jus.stf.digital:core (>=2.0.0 <=2.3.1), cloud.altemista.fwk.microservices:cloud-altemistafwk-core-microservices-zipkin-conf (>=3.0.0.RELEASE <=3.0.1.RELEASE) +983 more potentially affected by CVE-2019-10184 via io.undertow:undertow-servlet (>=1.0.0.Alpha1 <=2.0.22.Final)
io.undertow:undertow-servlet MAVEN version =1.0.0.Alpha1, =2.0.0, =3.0.0.RELEASE, =0.0.1-jdk1.8-RELEASES, =0.0.1-jdk1.8-RELEASES, =0.1.4-jdk1.8-RELEASES, =0.0.4, =0.2.7, =0.0.1, =0.0.1, =0.0.1, =0.2.0, =0.7.0 and more Source cves: CVE-2019-10184 Source advisory: OSV:GHSA-W69W-JVC7-WJGV...
CVE-2019-10184
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...
CVE-2019-7315
Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interface, as demonstrated by reading /etc/shadow. NOTE: this product is discontinued, and its final firmware version has this vulnerability 4.x versions exist only...
PT-2019-7839 · Red Hat · Business Central +1
Name of the Vulnerable Software and Affected Versions: KIE server and Business Central versions prior to 7.21.0.Final Description: A security issue has been reported where username and password are stored as plaintext Java properties. This allows any application deployed on the same server to...
keycloak: infinite loop in session replacement leading to denial of service
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...
The vulnerability of Blink’s rendering module in Google Chrome web browsers allows a hacker to trigger a service failure.
The vulnerability of Google Chrome’s Blink rendering module is related to errors in processing the position of the final character during the rendering of the front panel, which leads to damage to the UI elements. Exploiting this vulnerability allows a remote attacker to cause service interruptio...
WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.3.52 - Authenticated Option Update vulnerability (Fremius Library security issue)
Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Image Photo Gallery Final Tiles Grid plugin versions = 3.3.52. Solution Update the WordPress Image Photo Gallery Final Tiles Grid plugin to the latest available version at least 3.3.57...
Mueller Investigation 2019: Indictments, Witnesses, and More
The special counsel has lots of unfinished business on his to-do list this year, including a final report. Here's a rundown...
DEBIAN-CVE-2018-16862
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation removal. The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one...
CVE-2018-14657
Keycloak 4.2.1.Final and 4.3.0.Final are affected by CVE-2018-14657. The root cause is an improper implementation of brute force detection when TOPT is enabled, resulting in the login protection not being enforced. Impact described across connected sources indicates brute force protection may not...
keycloak: auth permitted with expired certs in SAML client
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks...
keycloak: XSS-Vulnerability with response_mode=form_post
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login...
PT-2018-12647 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak versions 4.2.1.Final, 4.3.0.Final Description: A flaw was found in the implementation of the Brute Force detection algorithm when TOPT is enabled, which will not enforce its protection measures. Recommendations: For Keycloak version...
AiOPMSD Final 1.0.0 - q SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: AiOPMSD Final 1.0.0 - 'q' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://aiopmsd.sourceforge.io/ Software Link: https://sourceforge.net/projects/aiopmsd/files/latest/download Version: 1.0.0 Category: Webapps...
AiOPMSD Final 1.0.0 - q SQL Injection
AiOPMSD Final 1.0.0 - q SQL Injection Exploit Title: AiOPMSD Final 1.0.0 - 'q' SQL Injection Dork: N/A Date: 2018-10-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://aiopmsd.sourceforge.io/ Software Link: https://sourceforge.net/projects/aiopmsd/files/latest/download Version: 1.0.0...
Academic Timetable Final Build 7.0b Cross Site Request Forgery
Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://geoffpartridge.net/ Software Link: https://sourceforge.net/projects/timetableacademic/files/latest/download Version: 7.0a-7.0b...
