12081 matches found
CVE-2019-10780
BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open...
Neowise CarbonFTP 1.4 Insecure Proprietary Password Encryption
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEOWISE-CARBONFTP-v1.4-INSECURE-PROPRIETARY-PASSWORD-ENCRYPTION.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.neowise.com Product CarbonFTP v1.4 CarbonFTP is a...
Yelp: No rate limiting for confirmation email lead to email flooding
Description: There is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Affected URL: https://biz.yelp.com/welcome/resendconfirmation with POST method Details: 1. Login to biz.yelp.com 2. Go to...
Servicing stack update for Windows 10, version 1903 and 1909: January 14, 2020
None None...
Atlassian JIRA < 7.13.12 / 8.x < 8.4.3 / 8.5.x < 8.5.2 Authorization Bypass (JRASERVER-70405)
According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.12, 8.x prior to 8.4.3, or 8.5.x prior to 8.5.2 / 8.6.0. It is, therefore, affected by an authorization bypass vulnerability. The vulnerability exists in the...
Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution
Posted by Samuel Groß, Project Zero This is the third and last post in a series about a remote, interactionless iPhone exploit over iMessage. The first blog post introduced the exploited vulnerability, and the second blog post described a way to perform a heapspray, leaking the shared cache base...
Cisco Data Center Network Manager getSwitchsDataLength SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Data Center Network Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of requests to the getSwitchsDataLength endpoin...
Cisco Data Center Network Manager getVsanDataLength SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Data Center Network Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...
Sencha Labs Connect Cross-Site Scripting Vulnerability
Sencha Labs Connect is an extensible HTTP server framework for Node.js. A cross-site scripting vulnerability exists in the 'connect.methodOverride' function in Sencha Labs Connect. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker cou...
Stripo Inc: csrf bypass using flash file + 307 redirect method at plugins endpoint
Hi Security team, i have found that the request sent to https://my.stripo.email/cabinet/stripeapi/v1/plugin/$userid$/plugins don't have any protection against csrf attacks as the server only validates that the content type is application/json and this can be bypassed using the flash file + 307...
mongo-express code execution vulnerability
mongo-express is a lightweight web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express versions prior to 0.54.0. An attacker can exploit this vulnerability to execute code with the help of an endpoint using the toBSON method...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
SonicWall Email Security Appliance Trust Management Issue Vulnerability
SonicWall Email Security Appliance is an email security appliance from SonicWall USA. A vulnerability with trust management issues exists in SonicWall Email Security Appliance version 10.0.2 and earlier. The vulnerability stems from the lack of an effective trust management mechanism in a network...
CVE-2019-16550
A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents...
jenkins-script-security-plugin: handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts...
Unspecified Vulnerability in Tecno Camon
The Tecno Camon is a Camon series smartphone from the Chinese company Transocean. An unspecified vulnerability exists in Tecno Camon. The vulnerability can be exploited to execute code or commands with system privileges to record the screen, restore factory settings, obtain the user's Wi-Fi...
Unspecified Vulnerability in Tecno Camon iClick
The Transn Tecno Camon iClick is a smartphone from the Chinese company Transn. An unspecified vulnerability exists in Tecno Camon iClick. The vulnerability can be exploited to execute code or commands with system privileges to record the screen, restore factory settings, obtain the user's Wi-Fi...
