7973 matches found
CVE-2019-12523
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers,...
CVE-2019-15288
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE, Cisco TelePresence Codec TC, and Cisco RoomOS Software could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The vulnerability is due to insufficient input...
CVE-2019-15967
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit th...
Design/Logic Flaw
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit th...
CVE-2019-15288 Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE, Cisco TelePresence Codec TC, and Cisco RoomOS Software could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The vulnerability is due to insufficient input...
Nokia IMPACT Path Traversal Vulnerability
Nokia IMPACT is a suite of intelligent management platforms for the Internet of Things IoT from the Finnish company Nokia. A path traversal vulnerability exists in Nokia IMPACT. The vulnerability arises from a failure of a networked system or product to properly filter special elements in a...
Xen CVE-2019-19579 Incomplete Fix Local Privilege Escalation Vulnerability
Description Xen is prone to a local privilege-escalation vulnerability. Local attacker can exploit this issue to gain elevated privileges on affected computers. Technologies Affected Xen Xen 3.0.2 Xen Xen 3.0.3 Xen Xen 3.0.4 Xen Xen 3.1 Xen Xen 3.1.3 Xen Xen 3.1.4 Xen Xen 3.2.0 Xen Xen 3.2.1 Xen...
Naver Vaccine Path Traversal Vulnerability
Naver Vaccine is a suite of computer security protection software from the Korean company Naver. Naver Vaccine suffers from a path traversal vulnerability. The vulnerability stems from a failure of a network system or product to properly filter for specific elements in a resource or file path. An...
The vulnerability of the RubyGems package management system’s installation mechanism allows a hacker to write any files into the device’s file system.
The vulnerability of the RubyGems package management system is related to errors in restricting the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to write any files into the device’s file system...
CloudBees Jenkins Support Core Plugin Path Traversal Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software release/testing projects and some timed tasks . Support Core Plugin is used in one of them to provide...
IBM Spectrum Protect CVE-2019-4406 Local Denial of Service Vulnerability
Description IBM Spectrum Protect is prone to local denial-of-service vulnerability. Successful exploits will allow local attackers to cause a denial-of-service conditions. Technologies Affected IBM Spectrum Protect 7.1.0.0 IBM Spectrum Protect 7.1.6.6 IBM Spectrum Protect 7.1.6.7 IBM Spectrum...
PT-2019-4192 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.x.x and 4.x.x before 4.18.0 Description: The issue is related to a heap overflow flaw in the Marvell WiFi chip driver of the Linux kernel. This flaw allows a remote attacker to cause a system crash, resulting in a deni...
Shack Forms Pro extension path traversal vulnerability in Joomla!
Joomla! is the U.S. Open Source Matters team using PHP and MySQL development of a set of open source, cross-platform content management system CMS. Shack Forms Pro extension is used in one of the form creation plugin . A path traversal vulnerability exists in the Shack Forms Pro extension for...
Cisco DNA Spaces Connector CVE-2019-15997 Local Command Injection Vulnerability
Description Cisco DNA Spaces Connector is prone to a local command-injection vulnerability. A local attacker can exploit this issue to execute arbitrary commands on the underlying OS with root privileges. This issue is being tracked by Cisco Bug ID CSCvp27714. Versions prior to Cisco DNA Spaces...
Lenovo System Interface Foundation Multiple Security Vulnerabilities
Description Lenovo System Interface Foundation is prone to multiple security vulnerabilities. An attacker can exploit these issues to execute arbitrary code or gain elevated privileges on the affected system. Versions prior to Lenovo System Interface Foundation 1.1.18.3 are vulnerable. Technologi...
Unspecified Vulnerability in ZyXEL GS1900 (CNVD-2019-41669)
ZyXEL GS1900 is a managed switch from ZyXEL Taiwan, China. A security vulnerability exists in the Zyxel GS1900 using firmware prior to version 2.50AAHH.0C0. An attacker could exploit the vulnerability to access restricted features...
Lenovo LenovoPaper CVE-2019-6191 Unspecified Local Privilege Escalation Vulnerability
Description Lenovo LenovoPaper software is prone to an unspecified local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges. Technologies Affected Lenovo LenovoPaper Recommendations Permit local access for trusted individuals only. Where possibl...
ghostscript: -dSAFER escape in .charkeys (701841)
A flaw was found in the .charkeys procedure, where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access...
The vulnerability of the Ruby interpreter’s methods Dir.open, Dir.new, Dir.entries, and Dir.empty allows attackers to gain unauthorized access to protected data or compromise the integrity of protected information.
The vulnerability of the Dir.open, Dir.new, Dir.entries, and Dir.empty methods in the Ruby programming language exists due to incorrect path name restrictions for restricted-access directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data or...
The vulnerability of the Advantech WebAccess remote monitoring software lies in the incorrect path name limitation for accessing the restricted directory. This allows a perpetrator to execute arbitrary code.
The vulnerability of the Advantech WebAccess remote monitoring software exists due to an incorrect path name limitation for accessing the restricted directory. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...