PT-2019-2428 · Microsoft · Windows Jet Database Engine +1

Name of the Vulnerable Software and Affected Versions: Windows Jet Database Engine affected versions not specified Description: The issue is related to errors in processing objects in memory within the Windows Jet Database Engine of the Windows operating system. It allows a remote attacker to...

Command Injection

Overview All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the service query parameter to an exec call. This may allow attackers to run arbitrary commands in the system...

GHSA-984P-XQ9M-4RJW Rate Limiting Bypass in express-brute

All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...

GHSA-86P3-4GFQ-38F2 Denial of Service in url-relative

All versions of url-relative are vulnerable to Denial of Service. If the values to and from are equal, the function hangs and never returns. This may cause a Denial of Service. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

PT-2022-7134 · X.Org +9 · X.Org +9

Name of the Vulnerable Software and Affected Versions: X.Org affected versions not specified Description: A security flaw was found in X.Org due to the XkbCopyNames function leaving a dangling pointer to freed memory. This results in out-of-bounds memory access on subsequent XkbGetKbdByName...

GHSA-7JFH-2XC9-CCV7 Cross-Site Scripting in public

All versions of public are vulnerable to stored cross-site scripting XSS. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time...

GHSA-27V7-QHFV-RQQ8 Insecure Credential Storage in web3

All versions of web3 are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Si...

PT-2019-15251 · Cisco · Cisco Nx-Os +1

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software affected versions not specified Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected...

PT-2019-2452 · Cisco · Cisco Nx-Os +1

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software affected versions not specified Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a...

PT-2019-9056 · Lg · Lg N1A1 Nas

Name of the Vulnerable Software and Affected Versions: LG N1A1 NAS version 3718.510 Description: The issue allows for remote command execution, enabling the execution of arbitrary code. The attack vector involves an HTTP POST request with specific parameters. Recommendations: For LG N1A1 NAS...

PT-2019-12629 · Remarkable · Remarkable

Name of the Vulnerable Software and Affected Versions: remarkable version 1.7.1 Description: The issue allows for Regular Expression Denial of Service ReDoS via a CDATA section in the lib/common/html re.js file. Recommendations: For version 1.7.1, at the moment, there is no information about a...

PT-2019-2087 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue exists due to insufficient validation of user-supplied input,...

PT-2019-16998 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.0.0.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

PT-2019-2121 · Cisco · Cisco Web Security Appliance

Name of the Vulnerable Software and Affected Versions: Cisco Web Security Appliance WSA affected versions not specified Description: A vulnerability in the log subscription subsystem could allow an authenticated, local attacker to perform command injection and elevate privileges to root. This iss...

PT-2019-11715 · Jenkins · Jenkins Twitter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Twitter Plugin affected versions not specified Description: The issue concerns the storage of credentials in the Jenkins Twitter Plugin. Specifically, it stores credentials unencrypted in its global configuration file on the Jenkins...

PT-2019-16861 · Ibm · Ibm Jazz Reporting Service

Name of the Vulnerable Software and Affected Versions: IBM Jazz Reporting Service JRS version 6.0.6 Description: The issue allows an authenticated user to access the execution log files as a guest user, potentially obtaining server execution information. Recommendations: For IBM Jazz Reporting...

PT-2019-16886 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.0.0.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Scale (CVE-2018-10237)

Summary There is a vulnerability in IBM WebSphere Application Server, used by IBM Spectrum Scale. This issue allow a remote attacker to cause a denial of service condition. Vulnerability Details IBM WebSphere Application Server is used to provide graphical user interface for managing Spectrum...

PT-2019-5244 · Graphicsmagick +2 · Graphicsmagick +2

Name of the Vulnerable Software and Affected Versions: GraphicsMagick affected versions not specified Description: The issue is related to insufficient input validation in the GraphicsMagick graphic editor. Exploitation of this issue may allow a remote attacker to cause a denial of service using ...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in PHP (CVE-2018-17082)

Summary IBM Advanced Management Module AMM has addressed the following vulnerability in PHP. Vulnerability Details CVEID: CVE-2018-17082 DESCRIPTION: PHP is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Apache2 component. A remote attacker could...