The vulnerability of the central control server of SiNVR 3 Central Control Server lies in security flaws in the XML-based communication protocol, allowing attackers to perform arbitrary actions on the vulnerable device.

The vulnerability of the central control server of SiNVR 3 Central Control Server is related to security vulnerabilities in the XML-based communication protocol. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

Remote Code Execution (RCE)

ncurses is vulnerable to denial of service. Due to a flaw, there is a format string vulnerability in the fmtentry function. A crafted input will lead to a remote arbitrary code execution attack...

CVE-2019-11999

Potential security vulnerabilities have been identified in HPE OpenCall Media Platform OCMP resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. For OCMP version 4.4.X -...

Cross site scripting

Potential security vulnerabilities have been identified in HPE OpenCall Media Platform OCMP resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. For OCMP version 4.4.X -...

CVE-2019-11999

CVE-2019-11999 concerns HPE OpenCall Media Platform (OCMP). Public docs describe a vulnerability in OCMP versions 4.4.x prior to 4.4.8 and 4.5.x prior to an updated release, enabling remote arbitrary file download and cross-site scripting due to insufficient input validation. The described fixes ...

CVE-2019-11999

Potential security vulnerabilities have been identified in HPE OpenCall Media Platform OCMP resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. For OCMP version 4.4.X -...

The vulnerability of the WebKit rendering module in OpenSUSE Leap operating systems, Mac OS X, iOS, tvOS, Safari browser, multimedia player iTunes, and iCloud service lies in the use of memory after it is freed. This allows an attacker to execute arbitrary code.

The vulnerability of the WebKit rendering module in operating systems such as Mac OS X, iOS, tvOS, Safari browser, multimedia player iTunes, and iCloud service is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code memor...

The vulnerability of Engine.IO’s WebSocket server protocol, related to the manipulation of cross-site requests, allows attackers to perform arbitrary actions on the vulnerable system.

The vulnerability of the WebSocket protocol in the Engine.IO web server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable system remotely...

The vulnerability in the web interface of the Cisco Webex Video Mesh software allows a malicious actor to execute arbitrary commands.

The vulnerability of the Cisco Webex Video Mesh software control web interface is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Huawei EulerOS: Security Advisory for ncurses (EulerOS-SA-2018-1166)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability in the web interface of the software-hardware management interface for Cisco Firepower Management Center allows a malicious actor to execute arbitrary SQL queries.

The vulnerability of the web interface for managing the software-hardware environment of Cisco Firepower Management Center is related to input validation errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Debian DLA-1896-1 : commons-beanutils security update

It was discovered that there was a remote arbitrary code vulnerability in commons-beanutils, a set of utilities for manipulating JavaBeans code. For Debian 8 'Jessie', this issue has been fixed in commons-beanutils version 1.9.2-1+deb8u1. We recommend that you upgrade your commons-beanutils...

CVE-2019-5395

HPE 3PAR Service Processor (SP) is vulnerable to a remote arbitrary file upload in versions prior to 5.0.5.1. Connected sources corroborate this CVE and indicate a high-impact outcome (C/H, I/H, A/H) over a network with low complexity, but the documents do not provide exploitation details or a st...

Node.js third-party modules: Lack of input validation and sanitization in react-autolinker-wrapper library causes XSS

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report XSS in...

CVE-2019-6139

Forcepoint User ID FUID server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability, upgrade to FUID version 1.3 or higher. To prevent the vulnerability on...

devolo dLAN 550 duo+ Starter Kit Remote Code Execution

Summary Devolo dLAN® 550 duo+ Starter Kit is Powerlineadapter which is a cost-effective and helpful networking alternative for any location without structured network wiring. Especially in buildings or residences lacking network cables or where updating the wiring would be expensive and...

CVE-2018-18589

CVE-2018-18589 concerns Micro Focus Real User Monitoring software with vulnerable versions: 9.26IP, 9.30, 9.40 and 9.50. Connected CVE data notes a Java deserialization vulnerability as the root cause, enabling potential remote arbitrary code execution. The CVE entry indicates the impact is remot...

The vulnerability of Watchguard’s wireless access points’ microprogramming software lies in the lack of sufficient file loading restrictions, allowing attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software of Watchguard wireless access points relates to insufficient restrictions on file downloads. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary commands...

EulerOS Virtualization 2.5.0 : ncurses (EulerOS-SA-2018-1252)

According to the versions of the ncurses packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In ncurses 6.0, there is a stack-based buffer overflow in the fmtentry function. A crafted input will lead to a remote arbitrary...

MacOS Malware Targets Cryptocurrency Community on Slack, Discord

Hackers using MacOS malware are targeting cryptocurrency investors that use both the Slack and Discord chat platforms. The malware, dubbed OSX.Dummy, uses an unsophisticated infection method, but those who are successfully attacked open their systems up to remote arbitrary code execution. “If the...