CVE-2019-12129: Missing Authentication for Critical Function

In ONAP MSB through Dublin, by accessing an applicable port 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271, an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager OOM setups are affected...

PT-2020-9292

Name of the Vulnerable Software and Affected Versions ONAP SO through Dublin ONAP Operations Manager OOM setups affected versions not specified Description The issue allows an attacker to gain full access to ONAP services without authentication by accessing specific ports, including 30234, 30290,...

CVE-2019-12130: Missing Authentication for Critical Function

In ONAP CLI through Dublin, by accessing an applicable port 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271, an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12126: Missing Authentication for Critical Function

In ONAP DCAE through Dublin, by accessing an applicable port 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271, an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager OOM setups are affected...

PT-2020-9291

Name of the Vulnerable Software and Affected Versions ONAP OOM versions through Dublin Description The issue allows an attacker to gain full access to ONAP services without authentication by accessing specific ports. All ONAP Operations Manager setups are affected. Recommendations For versions...

CVE-2019-12128: Missing Authentication for Critical Function

In ONAP SO through Dublin, by accessing an applicable port 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271, an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager OOM setups are affected...

CVE-2019-18998: Improper Access Control

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly...

CVE-2020-5239

In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All...

CVE-2020-5239

In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All...

CVE-2020-5239: Incorrect Authorization

In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All...

PT-2020-18335

Name of the Vulnerable Software and Affected Versions Mailu versions prior to 1.7 Description An authenticated user can exploit a vulnerability in the Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers with open registration or untrusted users are most impacted...

Prima Systems FlexAir Authentication Bypass (CVE-2019-7667)

An authentication bypass vulnerability exists in Prima Systems FlexAir Access Control Database. Successful exploitation of this vulnerability could allow an attacker to download the database file, disclose login information, and have full access to the system...

CVE-2019-18345: Improper Neutralization of Input During Web Page Generation

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...

CVE-2019-18418

clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management...

ClonOS WEB control panel authorization issue vulnerability

ClonOS is an open source platform based on FreeBSD. The platform is mainly used for the creation and management of virtual environments. web control panel is one of the web-based ClonOS control panel. An authorization issue vulnerability exists in the clonos.php file in ClonOS WEB control panel...

CVE-2019-18418: Session Fixation

clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management...

Telegram Desktop (session hijacking) Payload Exploit

This vulnerability makes you able to Get full access. By hijacking User session using payload...

Cross site scripting

Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI...

PT-2019-14439

Name of the Vulnerable Software and Affected Versions Socomec DIRIS A-40 devices version prior to 48250501 Description The issue allows a remote attacker to gain full access to a device through the web interface. This is achieved by accessing the "/password.jsn" URI, which discloses passwords...

Design/Logic Flaw

DISPUTED Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them alread...