Vercel: through %09 Character the attacker is able to steal Github Token [ Account Takeover ]

Summary: Hello i've found the filter will deleted this %09 character when checking the value parameter next in oauth which allow to attacker to bypass Filter and steal Oauth Token of user thats lead to account takeover ! Steps To Reproduce: 1. Go To...

The vulnerability of clients of Check Point Endpoint Security’s comprehensive network endpoint protection solution, specifically for Windows and ZoneAlarm firewalls, stems from permission handling errors. This allows attackers to escalate their privileges.

The vulnerability of Check Point Endpoint Security Initial Client for Windows and ZoneAlarm, a network firewall, relates to permission handling errors. Exploiting this vulnerability can allow attackers to enhance their privileges through hard links from registration file archives...

The vulnerability of the process for creating management certificates, which involves identifying and accessing the server for service providers of Juniper Networks’ SBR Carrier, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the process for creating certificates that manage identity and access to servers for Juniper Networks SBR Carrier service providers is related to deficiencies in the protection of registration data. Exploiting this vulnerability could allow a perpetrator to gain unauthorized...

The vulnerability of the McAfee Advanced Threat Defense software’s database storage mechanism allows a malicious actor to gain unauthorized access to the root password.

The vulnerability of the McAfee Advanced Threat Defense software’s database storage component is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to obtain unauthorized access to the root password...

CVE-2019-4444

IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the browser instance and local system credentials can steal the credentials used for registration. IBM X-Force ID: 163453...

CVE-2019-4444

IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the browser instance and local system credentials can steal the credentials used for registration. IBM X-Force ID: 163453...

IBM API Connect Information Disclosure Vulnerability (CNVD-2019-46451)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. An information disclosure vulnerability exists in IBM API Connect versions 2018.1 through...

CVE-2014-3536

CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...

CVE-2014-3536

CFME CloudForms Management Engine 5: RHN account information is logged to topoutput.log during registration...

CVE-2014-3536

CVE-2014-3536 affects Red Hat CloudForms Management Engine (CFME) version 5. The vulnerability stems from CFME logging RHN account information to top_output.log during the registration process, leading to potential information disclosure. Multiple connected records corroborate the issue as a disc...

CVE-2019-19526

A use-after-free flaw was found in the pn533usbprobe USB interface in the Linux kernel. If the driver registration fails it needs to do all the cleanup activity and free all the related resources. A malicious USB device can cause this process to fail, causing a use-after-free vulnerability. Syste...

Security Bulletin: Unvalidated certificate import in IBM Business Automation Workflow (CVE-2019-4711)

Summary APAR JR61324 is available for IBM Business Automation Workflow BAW 19.0.0.2. It introduces a new API to register BAW at Resource Registry to support integrating processes in App Designer in Cloud Pak for Automation. During the registration process a TLS certifcate is imported without...

Product Key Explorer 4.2.0.0 - (Name) Denial of Service Exploit

Exploit Title: Product Key Explorer 4.2.0.0 - 'Name' Denial of Service POC Discovery by: SajjadBnd Vendor Homepage: http://www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/productkeyexplorersetup.exe Tested Version: 4.2.0.0 Vulnerability Type: Denial of Service DoS Local Tested...

The vulnerability of the libcurl library, related to insufficient protection of registration data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the libcurl library is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

SpotAuditor 5.3.2 Denial Of Service

Exploit Title: SpotAuditor 5.3.2 - 'Key' Denial of Service Exploit Author : ZwX Exploit Date: 2019-11-28 Vendor Homepage : http://www.nsauditor.com/ Link Software : http://spotauditor.nsauditor.com/downloads/spotauditorsetup.exe Tested on OS: Windows 7 Social: twitter.com/ZwX2a ''' Proof of Conce...

CVE-2019-15958

A vulnerability in the REST API of Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input...

Input validation

A vulnerability in the REST API of Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input...

CVE-2019-15958 Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability

A vulnerability in the REST API of Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input...

CVE-2019-15958 Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability

A vulnerability in the REST API of Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input...

UBUNTU-CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...