CVE-2019-3394

There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under /confluence/WEB-INF directory, which may contain configuration...

Arbitrary file deletion

There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under /confluence/WEB-INF directory, which may contain configuration...

CVE-2019-3394

CVE-2019-3394 affects Atlassian Confluence Server/Data Center: a local file disclosure in the page export feature allows an authenticated attacker with page-edit permission to read arbitrary files under the Confluence install directory (notably /confluence/WEB-INF). Impact could include leakage o...

CVE-2019-3394

There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under /confluence/WEB-INF directory, which may contain configuration...

Cross-site Scripting in Ignite Realtime Openfire

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

GHSA-5QFV-RR79-CHX5 Cross-site Scripting in Ignite Realtime Openfire

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

Cross-site Scripting (XSS)

Openfire Core XMPP Server is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize the parameters in LDAP setup test, allowing an attacker to inject arbitrary script through it...

CVE-2019-15488

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

CVE-2019-15488

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

Cross site scripting

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

CVE-2019-15488

CVE-2019-15488 affects Ignite Realtime Openfire before 4.4.1, where the LDAP setup test endpoint processes input in a way that allows a reflected XSS payload. The issue is described as a reflected XSS via the LDAP setup test in multiple sources (Openfire, Red Hat advisory, OSV, etc.). No explicit...

CVE-2019-15488

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind

It is an offensive tool for Java. This PoC exploit targets CVE-2...

CVE-2019-6143

Forcepoint Next Generation Firewall Forcepoint NGFW 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The...

CVE-2019-6143

Forcepoint Next Generation Firewall Forcepoint NGFW 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The...

Authentication flaw

Forcepoint Next Generation Firewall Forcepoint NGFW 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The...

CVE-2019-6143

The CVE-2019-6143 entry concerns Forcepoint Next Generation Firewall (NGFW) platforms. Affected versions include 6.4.x prior to 6.4.7, 6.5.x prior to 6.5.4, and 6.6.x prior to 6.6.2. The flaw is an authentication vulnerability that can allow an unauthorized user to bypass password authentication ...

CVE-2019-6143

Forcepoint Next Generation Firewall Forcepoint NGFW 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The...

Denial Of Service (DoS)

PHP is vulnerable to denial of service DoS. A NULL pointer dereference is possible due to mishandling of ldapgetdn return value, allowing DoS via malicious LDAP server reply...

Local File Disclosure via Word Export in Confluence Server - CVE-2019-3394

Confluence Server and Data Center had a local file disclosure vulnerability in the page export function. A remote attacker who has Add Page space permission would be able to read arbitrary files in the /confluence/WEB-INF/ directory and it's subdirectories, which may contain configuration files...